Apache Airflow vulnerable to CSRF Attacks

高危 8.8CVE-2019-0229 · GHSA-w6j4-3gh2-9f5j · PYSEC-2019-215 · Published 10/04/2019 · updated 17/06/2026

要点

CVE-2019-0229 是影响 apache-airflow, airflow (apache) 的高危 (CVSS 8.8)漏洞。
未来 30 天内被利用的概率（EPSS）：1.6%，高于 75.3% 的漏洞。
修复：升级到 1.10.3, 1.10.3b1 或更高版本。

Package	Affected versions	Patched versions
apache-airflow PyPI	`< 1.10.3< 1.10.3b1`	`1.10.31.10.3b1`
airflow apache	`≤ 1.10.2`	No fix yet

Description

A number of HTTP endpoints in the Airflow webserver (both RBAC and classic) did not have adequate protection and were vulnerable to cross-site request forgery attacks.

NVD description

A number of HTTP endpoints in the Airflow webserver (both RBAC and classic) did not have adequate protection and were vulnerable to cross-site request forgery attacks.

References

apache-airflow 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

apache-airflow

PyPI

< 1.10.3< 1.10.3b1

1.10.31.10.3b1

airflow

apache

≤ 1.10.2

No fix yet

Description

A number of HTTP endpoints in the Airflow webserver (both RBAC and classic) did not have adequate protection and were vulnerable to cross-site request forgery attacks.

NVD description

A number of HTTP endpoints in the Airflow webserver (both RBAC and classic) did not have adequate protection and were vulnerable to cross-site request forgery attacks.

apache-airflow 的其他漏洞

查看全部 →