CVE-2023-49920: Apache Airflow Cross-Site Request Forgery vulnerability
(updated )
Apache Airflow, version 2.7.0 through 2.7.3, has a vulnerability that allows an attacker to trigger a DAG in a GET request without CSRF validation. As a result, it was possible for a malicious website opened in the same browser - by the user who also had Airflow UI opened - to trigger the execution of DAGs without the user’s consent. Users are advised to upgrade to version 2.8.0 or later which is not affected
References
- github.com/advisories/GHSA-6m9r-7wrx-xmr6
- github.com/apache/airflow
- github.com/apache/airflow/commit/f5d802791fa5f6b13b635f06a1ea2eccc22a9ba7
- github.com/apache/airflow/pull/36026
- github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-266.yaml
- lists.apache.org/thread/mnwd2vcfw3gms6ft6kl951vfbqrxsnjq
- nvd.nist.gov/vuln/detail/CVE-2023-49920
Code Behaviors & Features
Detect and mitigate CVE-2023-49920 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →