CVE-2017-17835
published 2019-01-23CVE-2017-17835: In Apache Airflow 1.8.2 and earlier, a CSRF vulnerability allowed for a remote command injection on a default install of Airflow.
PriorityP344high8.8CVSS 3.0
AVNACLPRNUIRSUCHIHAH
EPSS
1.29%
67.0th percentile
In Apache Airflow 1.8.2 and earlier, a CSRF vulnerability allowed for a remote command injection on a default install of Airflow.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | airflow | <= 1.8.2 | — |
| apache_software_foundation | apache_airflow | — | — |
CVSS provenance
nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Cross-Site Request Forgery (CSRF) in Apache Airflow
ghsa·2019-01-25
CVE-2017-17835 [HIGH] CWE-352 Cross-Site Request Forgery (CSRF) in Apache Airflow
Cross-Site Request Forgery (CSRF) in Apache Airflow
In Apache Airflow 1.8.2 and earlier, a CSRF vulnerability allowed for a remote command injection on a default install of Airflow.
OSV
Cross-Site Request Forgery (CSRF) in Apache Airflow
osv·2019-01-25
CVE-2017-17835 [HIGH] Cross-Site Request Forgery (CSRF) in Apache Airflow
Cross-Site Request Forgery (CSRF) in Apache Airflow
In Apache Airflow 1.8.2 and earlier, a CSRF vulnerability allowed for a remote command injection on a default install of Airflow.
OSV
CVE-2017-17835: In Apache Airflow 1
osv·2019-01-23
CVE-2017-17835 CVE-2017-17835: In Apache Airflow 1
In Apache Airflow 1.8.2 and earlier, a CSRF vulnerability allowed for a remote command injection on a default install of Airflow.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2019-01-23
Published