Lucene search

K
osvGoogleOSV:GHSA-RG94-84XJ-7GQ3
HistoryNov 15, 2022 - 12:00 p.m.

Apache Airflow Contains Open Redirect

2022-11-1512:00:15
Google
osv.dev
13
apache airflow
open redirect
webserver

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.004

Percentile

73.5%

In Apache Airflow versions prior to 2.4.3, there was an open redirect in the webserver’s /login endpoint.

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.004

Percentile

73.5%