Skip to content
OpenAdvisories
High · 8.8 CVE-2017-17835 EUVD-2019-0013GHSA-68wv-rjrm-576pPYSEC-2019-148

Cross-Site Request Forgery (CSRF) in Apache Airflow

Published Jan 23, 2019 · Updated Sep 16, 2024 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Airflow Package: apache-airflow Ecosystem: PyPI

Description

In Apache Airflow 1.8.2 and earlier, a CSRF vulnerability allowed for a remote command injection on a default install of Airflow.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Airflow Apache Airflow <= 1.8.2 —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI apache-airflow < 1.9.0 1.9.0 GHSA-68wv-rjrm-576p

References