CVE-2023-49920PYSEC-2023-266BIT-AIRFLOW-2023-49920GHSA-6M9R-7WRX-XMR6
Apache Airflow: Missing CSRF protection on DAG/trigger
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 2.8.0, 2.8.0b1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Apache Airflow, version 2.7.0 through 2.7.3, has a vulnerability that allows an attacker to trigger a DAG in a GET request without CSRF validation. As a result, it was possible for a malicious website opened in the same browser - by the user who also had Airflow UI opened - to trigger the execution of DAGs without the user's consent. Users are advised to upgrade to version 2.8.0 or later which is not affected
Timeline
- CVE published
- Record last updated
Affected versions
- apache-airflow
From 2.7.0 · fixed in 2.8.0
- apache-airflowPyPI
From 2.7.0 · fixed in 2.8.0b1
- apache-airflowPyPI
From 2.7.0 · fixed in 2.8.0