cve-2023-49920
Vulnerability from cvelistv5
Published
2023-12-21 09:27
Modified
2024-08-02 22:09
Severity
Summary
Apache Airflow: Missing CSRF protection on DAG/trigger
References
| Source | URL | Tags |
|---|---|---|
| security@apache.org | http://www.openwall.com/lists/oss-security/2023/12/21/3 | Mailing List, Third Party Advisory |
| security@apache.org | https://github.com/apache/airflow/pull/36026 | Patch |
| security@apache.org | https://lists.apache.org/thread/mnwd2vcfw3gms6ft6kl951vfbqrxsnjq | Mailing List, Third Party Advisory |
Impacted products
| Vendor | Product |
|---|---|
| Apache Software Foundation | Apache Airflow |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T22:09:49.196Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"patch",
"x_transferred"
],
"url": "https://github.com/apache/airflow/pull/36026"
},
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.apache.org/thread/mnwd2vcfw3gms6ft6kl951vfbqrxsnjq"
},
{
"tags": [
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2023/12/21/3"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pypi.python.org",
"defaultStatus": "unaffected",
"packageName": "apache-airflow",
"product": "Apache Airflow",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "2.8.0",
"status": "affected",
"version": "2.7.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tareq Ahamed ( 0xt4req)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jens Scheffler"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Apache Airflow, version 2.7.0 through 2.7.3, has a vulnerability that allows an attacker to trigger a DAG in a GET request without CSRF validation.\u0026nbsp;As a result, it was possible for a malicious website opened in the same browser - by the user who also had Airflow UI opened - to trigger the execution of DAGs without the user\u0027s consent.\u003cbr\u003eUsers are advised to upgrade to version 2.8.0 or later which is not affected"
}
],
"value": "Apache Airflow, version 2.7.0 through 2.7.3, has a vulnerability that allows an attacker to trigger a DAG in a GET request without CSRF validation.\u00a0As a result, it was possible for a malicious website opened in the same browser - by the user who also had Airflow UI opened - to trigger the execution of DAGs without the user\u0027s consent.\nUsers are advised to upgrade to version 2.8.0 or later which is not affected"
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-12-21T09:27:09.651Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/apache/airflow/pull/36026"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/mnwd2vcfw3gms6ft6kl951vfbqrxsnjq"
},
{
"url": "http://www.openwall.com/lists/oss-security/2023/12/21/3"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Apache Airflow: Missing CSRF protection on DAG/trigger",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2023-49920",
"datePublished": "2023-12-21T09:27:09.651Z",
"dateReserved": "2023-12-02T15:33:40.610Z",
"dateUpdated": "2024-08-02T22:09:49.196Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2023-49920\",\"sourceIdentifier\":\"security@apache.org\",\"published\":\"2023-12-21T10:15:36.330\",\"lastModified\":\"2023-12-28T13:49:22.483\",\"vulnStatus\":\"Analyzed\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"Apache Airflow, version 2.7.0 through 2.7.3, has a vulnerability that allows an attacker to trigger a DAG in a GET request without CSRF validation.\u00a0As a result, it was possible for a malicious website opened in the same browser - by the user who also had Airflow UI opened - to trigger the execution of DAGs without the user\u0027s consent.\\nUsers are advised to upgrade to version 2.8.0 or later which is not affected\"},{\"lang\":\"es\",\"value\":\"Apache Airflow, desde versi\u00f3n 2.7.0 a 2.7.3, tiene una vulnerabilidad que permite a un atacante activar un DAG en una solicitud GET sin validaci\u00f3n CSRF. Como resultado, era posible que un sitio web malicioso abierto en el mismo navegador (por el usuario que tambi\u00e9n ten\u00eda abierta la interfaz de usuario de Airflow) desencadenara la ejecuci\u00f3n de DAG sin el consentimiento del usuario. Se recomienda a los usuarios que actualicen a la versi\u00f3n 2.8.0 o posterior, que no se ve afectada.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security@apache.org\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-352\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.7.0\",\"versionEndIncluding\":\"2.7.3\",\"matchCriteriaId\":\"122817C2-2AA2-4D75-85C1-CDC07B9531A8\"}]}]}],\"references\":[{\"url\":\"http://www.openwall.com/lists/oss-security/2023/12/21/3\",\"source\":\"security@apache.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/apache/airflow/pull/36026\",\"source\":\"security@apache.org\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.apache.org/thread/mnwd2vcfw3gms6ft6kl951vfbqrxsnjq\",\"source\":\"security@apache.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]}]}}"
}
}
Loading...