CVE-2017-17836

EPSS 0.58%
Veröffentlicht 23.01.2019 17:29:00
Zuletzt bearbeitet 21.11.2024 03:18:47
Quelle security@apache.org
Teams Watchlist Login
Unerledigt Login

In Apache Airflow 1.8.2 and earlier, an experimental Airflow feature displayed authenticated cookies, as well as passwords to databases used by Airflow. An attacker who has limited access to airflow, whether it be via XSS or by leaving a machine unlocked can exfiltrate all credentials from the system.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 0 Referenzen 4

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Apache ≫ Airflow Version <= 1.8.2

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.58%	0.662

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	9.8	3.9	5.9	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov	5	10	2.9	AV:N/AC:L/Au:N/C:P/I:N/A:N

https://lists.apache.org/thread.html/ade4d54ebf614f68dc81a08891755e60ea58ba88e0209233eeea5f57%40%3Cdev.airflow.apache.org%3E

https://nvd.nist.gov/vuln/detail/CVE-2017-17836

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2017-17836

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2017-17836

EUVD