CVE-2023-49920: Apache Airflow: Missing CSRF protection on DAG/trigger
Apache Airflow, version 2.7.0 through 2.7.3, has a vulnerability that allows an attacker to trigger a DAG in a GET request without CSRF validation. As a result, it was possible for a malicious website opened in the same browser - by the user who also had Airflow UI opened - to trigger the execution of DAGs without the user's consent. Users are advised to upgrade to version 2.8.0 or later which is not affected
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2023-49920?
The severity of CVE-2023-49920 is classified as medium due to the possibility of an attacker triggering actions via CSRF without validation.
How do I fix CVE-2023-49920?
To fix CVE-2023-49920, upgrade Apache Airflow to version 2.8.0 or later.
Which versions of Apache Airflow are affected by CVE-2023-49920?
Apache Airflow versions 2.7.0 through 2.7.3 are affected by CVE-2023-49920.
What attack vector is associated with CVE-2023-49920?
CVE-2023-49920 can be exploited through a GET request from a malicious website when the Airflow UI is open in the same browser.
Is there a known exploit for CVE-2023-49920?
While there is no public exploit reported, the vulnerability does present a risk if exploited by a malicious actor.