CVE-2020-17526

published 2020-12-21

CVE-2020-17526: Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a malicious airflow user on site A where they log…

high 7.7 CVSS 3.1

AV N AC L PR L UI N S C C H I N A N

EXPLOIT

Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a malicious airflow user on site A where they log in normally, to access unauthorized Airflow Webserver on Site B through the session from Site A. This does not affect users who have changed the default value for `[webserver] secret_key` config.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
apache	airflow	< 1.10.14	1.10.14
apache_software_foundation	apache_airflow	>= Apache Airflow < 1.10.14	1.10.14

CWE-269