CVE-2017-15720
published 2019-01-23CVE-2017-15720: In Apache Airflow 1.8.2 and earlier, an authenticated user can execute code remotely on the Airflow webserver by creating a special object.
PriorityP350high8.8CVSS 3.0
AVNACLPRLUINSUCHIHAH
EPSS
2.04%
79.1th percentile
In Apache Airflow 1.8.2 and earlier, an authenticated user can execute code remotely on the Airflow webserver by creating a special object.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | airflow | <= 1.8.2 | — |
| apache_software_foundation | apache_airflow | — | — |
CVSS provenance
nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Improper Input Validation in Apache Airflow resulting in Remote Code Execution
ghsa·2019-01-25
CVE-2017-15720 [HIGH] CWE-20 Improper Input Validation in Apache Airflow resulting in Remote Code Execution
Improper Input Validation in Apache Airflow resulting in Remote Code Execution
In Apache Airflow 1.8.2 and earlier, an authenticated user can execute code remotely on the Airflow webserver by creating a special object.
OSV
Improper Input Validation in Apache Airflow resulting in Remote Code Execution
osv·2019-01-25
CVE-2017-15720 [HIGH] Improper Input Validation in Apache Airflow resulting in Remote Code Execution
Improper Input Validation in Apache Airflow resulting in Remote Code Execution
In Apache Airflow 1.8.2 and earlier, an authenticated user can execute code remotely on the Airflow webserver by creating a special object.
OSV
CVE-2017-15720: In Apache Airflow 1
osv·2019-01-23
CVE-2017-15720 CVE-2017-15720: In Apache Airflow 1
In Apache Airflow 1.8.2 and earlier, an authenticated user can execute code remotely on the Airflow webserver by creating a special object.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2019-01-23
Published