Incorrect Session Validation in Apache Airflow
Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a malicious airflow user on site A where they log in normally, to access unauthorized Airflow Webserver on Site B through the session from Site A. This does not affect users who have changed the default value for `[webserver] secret_key` config.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2020-17526US | high7.7OT erhöht | — | ||
Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a malicious airflow user on site A where they log in normally, to acce… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://www.openwall.com/lists/oss-security/2020/12/21/1WEB
- https://github.com/advisories/GHSA-7mx5-x372-xh87ADVISORY
- https://github.com/apache/airflowPACKAGE
- https://github.com/apache/airflow/commit/2f3b1c780472afd4c8a93633e6633feb7083792eWEB
- https://github.com/apache/airflow/commit/6b065840323f9a4fc8e372b458d26e419e4fa99bWEB
- https://github.com/apache/airflow/commit/97b2735d65e95c4633966667b6db3908540f3937WEB
- https://github.com/apache/airflow/commit/9e01476a50b9be27c4b1e6c6e24d36f290629195WEB
- https://github.com/apache/airflow/commit/a8900fa5f2b8963e9f57ba4ae5520a5d339aeaadWEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan