Apache Airflow, version 2.7.0 through 2.7.3, has a vulnerability that allows an attacker to trigger a DAG in a GET request without CSRF validation. As a result, it was possible for a malicious website opened in the same browser - by the user who also had Airflow UI opened - to trigger the execution of DAGs without the user's consent. Users are advised to upgrade to version 2.8.0 or later which is not affected

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Apache Airflow, version 2.7.0 through 2.7.3, has a vulnerability that allows an attacker to trigger a DAG
    in a GET request without CSRF validation. As a result, it was possible for a malicious website opened in
    the same browser - by the user who also had Airflow UI opened - to trigger the execution of DAGs without
    the user's consent. Users are advised to upgrade to version 2.8.0 or later which is not affected
    (CVE-2023-49920)

ID	Name	Product	Family	Type	Severity
462456	Echo: apache-airflow: security update to 2.8.0	Tenable Cloud Security	Echo Local Security Checks	Local	medium
462456	Echo: apache-airflow: security update to 2.8.0	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
411524	SCA: security update for apache-airflow (GHSA-6m9r-7wrx-xmr6)	Tenable Cloud Security	SCA Checks	Local	medium
411524	SCA: security update for apache-airflow (GHSA-6m9r-7wrx-xmr6)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2023-49920

medium

Tenable Plugins

medium

medium

medium

medium