Apache Airflow
5 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2020-13927 | Apache Airflow <1.10.11 | The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security ri | CRITICAL 9.8 | 100 % | KEV | |
| CVE-2020-13944 | Apache Airflow < 1.10.12 | In Apache Airflow < 1.10.12, the "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. | MEDIUM 6.1 | 25 % | ||
| CVE-2019-12417 | Apache Airflow up to 1.10.5 | A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page view | MEDIUM 4.8 | 1.3 % | ||
| CVE-2019-0216 | Apache Airflow <= 1.10.2 | A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page view | MEDIUM 4.8 | 2.7 % | ||
| CVE-2019-0229 | Apache Airflow <= 1.10.2 | A number of HTTP endpoints in the Airflow webserver (both RBAC and classic) did not have adequate protection and were vulnerable to cross-si | HIGH 8.8 | 1.6 % |