VDB
CVE-2020-11981
CVE-2020-11981
PUBLISHED
CVSS 9.800000190734863 CRITICAL
An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect to the broker (Redis, RabbitMQ) directly, it is possible to inject commands, resulting in the celery worker running arbitrary commands.
EPSS 36.54% · 98.3th percentile
Risk Scores
CVSS 3.1
9.800000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
36.54%
98.3th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bitnami | airflow | 0 |
| Bitnami | airflow | 0, 0, 0 |
Timeline
- Jul 16, 2020 CVE Published
- Apr 14, 2021 EPSS Score
- Jan 6, 2022 EPSS Score
- Feb 4, 2022 EPSS Score
- Apr 1, 2022 EPSS Score
- Mar 7, 2023 EPSS Score
- Apr 1, 2023 EPSS Score
- May 12, 2023 EPSS Score
- May 19, 2023 EPSS Score
- Jun 8, 2023 EPSS Score
- Apr 17, 2024 EPSS Score
- Aug 9, 2024 EPSS Score