Vulnetix
Try Vulnetix Request Demo
CVE-2020-17526 PUBLISHED

Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a malicious airflow user on site A where they log in normally, to access unauthorized Airflow Webserver on Site B through the session from Site A. This does not affect users who have changed the default value for `[webserver] secret_key` config.

EPSS 91.17% · 99.6th percentile

Risk Scores

EPSS Score
91.17%
99.6th percentile

Affected Products

VendorProductVersions
Bitnamiairflow0, 0, 0
Bitnamiairflow0

Timeline

References

Open in Interactive Console →