Incorrect Session Validation in Apache Airflow
Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a malicious airflow user on site A where they log in normally, to access unauthorized Airflow Webserver on Site B through the session from Site A. This does not affect users who have changed the default value for `[webserver] secret_key` config.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2020-17526US | high7.7OT elevated | — | ||
Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a malicious airflow user on site A where they log in normally, to acce… | ||||
02
references
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2020/12/21/1WEB
- https://github.com/advisories/GHSA-7mx5-x372-xh87ADVISORY
- https://github.com/apache/airflowPACKAGE
- https://github.com/apache/airflow/commit/2f3b1c780472afd4c8a93633e6633feb7083792eWEB
- https://github.com/apache/airflow/commit/6b065840323f9a4fc8e372b458d26e419e4fa99bWEB
- https://github.com/apache/airflow/commit/97b2735d65e95c4633966667b6db3908540f3937WEB
- https://github.com/apache/airflow/commit/9e01476a50b9be27c4b1e6c6e24d36f290629195WEB
- https://github.com/apache/airflow/commit/a8900fa5f2b8963e9f57ba4ae5520a5d339aeaadWEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan