CVE-2023-49920

CWE-352 — Cross-Site Request Forgery (CSRF)6 documents5 sources

Severity

6.5MEDIUM

EPSS

0.2%

top 60.91%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Apache Software Foundation Apache Airflow Apache Airflow

Timeline

PublishedDec 21

Latest updateJan 9

Description

Apache Airflow, version 2.7.0 through 2.7.3, has a vulnerability that allows an attacker to trigger a DAG in a GET request without CSRF validation. As a result, it was possible for a malicious website opened in the same browser - by the user who also had Airflow UI opened - to trigger the execution of DAGs without the user's consent. Users are advised to upgrade to version 2.8.0 or later which is not affected

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

▶PyPIapache-airflow2.7.0 — 2.8.0+1

▶CVEListV5apache_software_foundation/apache_airflow2.7.0 — 2.8.0

▶NVDapache/airflow2.7.0 — 2.7.3

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

CVEList

Apache Airflow: Missing CSRF protection on DAG/trigger↗2023-12-21

▶

GHSA

Apache Airflow Cross-Site Request Forgery vulnerability↗2023-12-21

▶

OSV

CVE-2023-49920: Apache Airflow, version 2↗2023-12-21

▶

OSV

Apache Airflow Cross-Site Request Forgery vulnerability↗2023-12-21

▶

💬Community

HackerOne

CVE-2023-49920: Apache Airflow: Missing CSRF protection on DAG/trigger↗2024-01-09

▶