{"id":"CVE-2023-49920","published":"2023-12-21T09:27:09Z","modified":"2025-02-13T17:18:58Z","title":"Apache Airflow: Missing CSRF protection on DAG/trigger","vendor":"Apache","product":"Apache Airflow","tier":"tail","description":{"text":"Apache Airflow, version 2.7.0 through 2.7.3, has a vulnerability that allows an attacker to trigger a DAG in a GET request without CSRF validation. As a result, it was possible for a malicious website opened in the same browser - by the user who also had Airflow UI opened - to trigger the execution of DAGs without the user's consent.\nUsers are advised to upgrade to version 2.8.0 or later which is not affected","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01032,"percentile":0.63775,"provenance":"source"},"cwes":[{"id":"CWE-352","name":"Cross-Site Request Forgery"}],"references":[{"url":"https://github.com/apache/airflow/pull/36026","tags":["patch"]},{"url":"https://lists.apache.org/thread/mnwd2vcfw3gms6ft6kl951vfbqrxsnjq","tags":["vendor-advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2023/12/21/3","tags":[]}],"priority":{"score":12.8,"factors":[{"name":"EPSS percentile","points":12.76}]},"vendorSlug":"apache","affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache Airflow","versions":[">= 2.7.0, < 2.8.0"]}],"affected":[{"ecosystem":"PyPI","package":"apache-airflow","vulnerableRanges":[">=2.7.0, <2.8.0",">=2.7.0, <2.8.0b1"],"patched":["2.8.0","2.8.0b1"],"from":["GHSA-6m9r-7wrx-xmr6","PYSEC-2023-266"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-0034","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2023-47037","published":"2023-11-12","fixed":"2.7.3","kev":false,"link":{"from":"CVE-2023-47037","to":"CVE-2023-49920","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:apache-airflow","fromFixed":"2.7.3","toFixed":"2.8.0b1","daysApart":39}]}},{"cve":"CVE-2023-47265","published":"2023-12-21","fixed":"2.8.0b1","kev":false},{"cve":"CVE-2023-48291","published":"2023-12-21","fixed":"2.8.0","kev":false},{"cve":"CVE-2023-49920","published":"2023-12-21","fixed":"2.8.0","kev":false},{"cve":"CVE-2023-50783","published":"2023-12-21","fixed":"2.8.0","kev":false},{"cve":"CVE-2023-50943","published":"2024-01-24","fixed":"2.8.1","kev":false},{"cve":"CVE-2023-50944","published":"2024-01-24","fixed":"2.8.1","kev":false}],"package":"PyPI:apache-airflow"}}