CVE-2017-17836: XSS
In Apache Airflow 1.8.2 and earlier, an experimental Airflow feature displayed authenticated cookies, as well as passwords to databases used by Airflow. An attacker who has limited access to airflow, weather it be via XSS or by leaving a machine unlocked can exfil all credentials from the system.
Other sources
In Apache Airflow 1.8.2 and earlier, an experimental Airflow feature displayed authenticated cookies, as well as passwords to databases used by Airflow. An attacker who has limited access to airflow, whether it be via XSS or by leaving a machine unlocked can exfiltrate all credentials from the system.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-17836?
CVE-2017-17836 is classified as a moderate severity vulnerability due to its potential for credential exfiltration.
How do I fix CVE-2017-17836?
To mitigate CVE-2017-17836, upgrade Apache Airflow to version 1.9.0 or later.
What could an attacker exploit in CVE-2017-17836?
An attacker could exploit CVE-2017-17836 to exfiltrate authenticated cookies and database passwords if they gain limited access to the Airflow system.
Which versions of Apache Airflow are affected by CVE-2017-17836?
CVE-2017-17836 affects Apache Airflow versions 1.8.2 and earlier.
Is CVE-2017-17836 related to XSS vulnerabilities?
Yes, CVE-2017-17836 can be exploited through XSS or by accessing an unlocked machine.