CVE-2020-17511 — Cleartext Storage of Sensitive Info in Software Foundation Apache Airflow

CWE-312 — Cleartext Storage of Sensitive Info5 documents4 sources
Severity
6.5MEDIUMNVD
EPSS
0.5%
top 34.52%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache Software Foundation Apache AirflowApache Airflow
Timeline
PublishedDec 14
Latest updateDec 17

Description

In Airflow versions prior to 1.10.13, when creating a user using airflow CLI, the password gets logged in plain text in the Log table in Airflow Metadatase. Same happened when creating a Connection with a password field.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶NVDapache/airflow< 1.10.13
▶CVEListV5apache_software_foundation/apache_airflowApache Airflow — 1.10.13

🔴Vulnerability Details

4
GHSA
Apache Airflow logs passwords in plaintext↗2020-12-17
▶
OSV
Apache Airflow logs passwords in plaintext↗2020-12-17
▶
OSV
CVE-2020-17511: In Airflow versions prior to 1↗2020-12-14
▶
CVEList
CVE-2020-17511: In Airflow versions prior to 1↗2020-12-14
▶
CVE-2020-17511 — Cleartext Storage of Sensitive Info | cvebase