Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Apache Airflow 1.10.13 Clear all filters
TI-2020-13262 CVE-2020-17513 · GHSA-6r3p-fcvm-xh7c

Server-side request forgery in Apache Airflow

Priority LOW 31

In Apache Airflow versions prior to 1.10.13, the Charts and Query View of the old (Flask-admin based) UI were vulnerable for SSRF attack.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.04377 Published 2020-12-14 Fixed in 1.10.13 CWE-918
TI-2020-13261 CVE-2020-17511 · GHSA-cvcq-gmc3-q6m8

Cleartext storage of sensitive information in Apache Airflow

Priority LOW 34

In Airflow versions prior to 1.10.13, when creating a user using airflow CLI, the password gets logged in plain text in the Log table in Airflow Metadatase.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.02618 Published 2020-12-14 Fixed in 1.10.13 CWE-312