Skip to content
OpenAdvisories
High 1 exploited CVE WID-SEC-2022-0184 10 CVEs

Fortinet FortiAnalyzer: Mehrere Schwachstellen

Published Jun 7, 2022 · Updated Nov 9, 2026 · Revision 2 · de

Vendor: Fortinet Product: FortiAnalyzer Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Fortinet FortiAnalyzer ausnutzen, um beliebigen Code auszuführen, vertrauliche Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen und Cross-Site-Scripting-Angriffe durchzuführen.

Product

FortiAnalyzer ist eine Plattform zur Protokollverwaltung, Analyse und Berichterstellung.

Vulnerabilities 10

  • Critical 9.8
    CVE-2020-13927 Exploited Public exploit Scanner template EPSS 100%

    Authentication bypass in Apache Airflow

    The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and …

    apache-airflow PyPI
    KEV Jan 18, 2022
  • Critical 9.8
    CVE-2020-11981 Public exploit Scanner template EPSS 37%

    Command injection via Celery broker in Apache Airflow

    An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect to the broker (Redis, RabbitMQ) directly, it is possible to inject commands, resulting in the celery worker running arbitrary commands.

    Apache Software Foundation Apache Airflow apache-airflow PyPI
  • Critical 9.8
    CVE-2020-11982

    Insecure default config of Celery worker in Apache Airflow

    An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attack can connect to the broker (Redis, RabbitMQ) directly, it was possible to insert a malicious payload directly to the broker which could lead to a deseriali…

    Apache Software Foundation Apache Airflow apache-airflow PyPI
  • High 7.7
    CVE-2020-17526 Scanner template EPSS 24%

    Incorrect Session Validation in Apache Airflow

    Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a malicious airflow user on site A where they log in normally, to access unauthorized Airflow Webserver on Site B through the session from Site A. Th…

    Apache Software Foundation Apache Airflow apache-airflow PyPI
  • Medium 6.1
    CVE-2020-13944 EPSS 25%

    Apache Airflow Cross-site Scripting

    In Apache Airflow < 1.10.12, the "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit.

    apache-airflow PyPI
  • Medium 6.1
    CVE-2020-17515 EPSS 16%

    Apache Airflow cross-site scripting due to incomplete fix for CVE-2020-13944

    The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions prior to 1.10.13. This is same as CVE-2020-13944 but the implemented fix in Airflow 1.10.13 did not fix the issue …

    Apache Software Foundation Apache Airflow apache-airflow PyPI
  • Medium 6.1
    CVE-2021-28359 EPSS 14%

    Apache Airflow Reflected XSS via Origin Query Argument in URL

    The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions <1.10.15 in 1.x series and affects 2.0.0 and 2.0.1 and 2.x series. This is the same as CVE-2020-13944 & CVE-2020-1…

    Apache Software Foundation Apache Airflow apache-airflow PyPI
  • Medium 5.9
    CVE-2021-23336 EPSS 41%

    Web Cache Poisoning

    The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called par…

    python-django python-django python3.4 python3.5 Debian Ubuntu Azure Linux Alpine
  • Medium 5.3
    CVE-2020-17513

    SSRF vulnerability in Apache Airflow

    In Apache Airflow versions prior to 1.10.13, the Charts and Query View of the old (Flask-admin based) UI were vulnerable for SSRF attack.

    Apache Software Foundation Apache Airflow apache-airflow PyPI
  • Medium 5.3
    CVE-2021-35936

    No Authentication on Logging Server

    If remote logging is not used, the worker (in the case of CeleryExecutor) or the scheduler (in the case of LocalExecutor) runs a Flask logging server and is listening on a specific port and also binds on 0.0.0.0 by default. This logging server had no authenti…

    Apache Software Foundation Apache Airflow apache-airflow PyPI

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-119905

  2. #1

    Initiale Fassung

References