CVE-2017-17836

EPSS 0.58%
Published 23.01.2019 17:29:00
Last modified 21.11.2024 03:18:47
Source security@apache.org
Teams watchlist Login
Open Login

In Apache Airflow 1.8.2 and earlier, an experimental Airflow feature displayed authenticated cookies, as well as passwords to databases used by Airflow. An attacker who has limited access to airflow, whether it be via XSS or by leaving a machine unlocked can exfiltrate all credentials from the system.

Affected products Warnungen 0 Metrics 3 CWE 0 References 4

Data is provided by the National Vulnerability Database (NVD)

Apache ≫ Airflow Version <= 1.8.2

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.58%	0.662

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	9.8	3.9	5.9	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov	5	10	2.9	AV:N/AC:L/Au:N/C:P/I:N/A:N

https://lists.apache.org/thread.html/ade4d54ebf614f68dc81a08891755e60ea58ba88e0209233eeea5f57%40%3Cdev.airflow.apache.org%3E

https://nvd.nist.gov/vuln/detail/CVE-2017-17836

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2017-17836

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2017-17836

EUVD