CWE-284 Improper Access Control on Configurations Endpoint for the Stable API (Apache Software Foundation Apache Airflow)
At a glance
- Source
- NVD
- EPSS
- EPSS 2.80 % · percentile 86 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- apache
- NVD status
- Modified
Description
Improper Access Control on Configurations Endpoint for the Stable API of Apache Airflow allows users with Viewer or User role to get Airflow Configurations including sensitive information even when `[webserver] expose_config` is set to `False` in `airflow.cfg`. This allowed a privilege escalation attack. This issue affects Apache Airflow 2.0.0.
Weaknesses (CWE)
- CWE-284 — Improper Access Control
References
- https://lists.apache.org/thread.html/r3b3787700279ec361308cbefb7c2cce2acb26891a12ce864e4a13c8d%40%3Cusers.airflow.apache.org%3E
- http://www.openwall.com/lists/oss-security/2021/02/17/1
- https://lists.apache.org/thread.html/rd142565996d7ee847b9c14b8a9921dcf80bc6bc160e3d9dca6dfc2f8%40%3Cannounce.apache.org%3E
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 4.0 | AV:N/AC:L/Au:S/C:P/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-ffw3-6mp6-jmvj — Improper Access Control in Apache Airflow
- PYSEC-2021-2 — Improper Access Control on Configurations Endpoint for the Stable API of Apache Airflow allows users with Viewer or User role to get Airflow Configurations incl
European references
- ENISA EUVD · EUVD-2021-0014
- GCVE · GCVE-0-2021-26559
Affected configurations (NVD CPE)
cpe:2.3:a:apache:airflow:2.0.0:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Apache Software Foundation · Apache Airflow | affected Apache Airflow 2.0.0 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |