CVE-2017-17836

In Apache Airflow 1.8.2 and earlier, an experimental Airflow feature displayed authenticated cookies, as well as passwords to databases used by Airflow. An attacker who has limited access to airflow, whether it be via XSS or by leaving a machine unlocked can exfiltrate all credentials from the system.

Score

CVSS 3.0 9.8 Critical

Status

Modified - security@apache.org

Published

2019-01-23

Last modified

2024-09-17

Weaknesses

CWE-255

Affected products

• Airflow (Apache)
• Apache Airflow (Apache Software Foundation)

References

• https://lists.apache.org/thread.html/ade4d54ebf614f68dc81a08891755e60ea58ba88e0209233eeea5f57%40%3Cdev.airflow.apache.o…