Security
Headlines
HeadlinesLatestCVEs

Headline

GHSA-6m9r-7wrx-xmr6: Apache Airflow Cross-Site Request Forgery vulnerability

Apache Airflow, version 2.7.0 through 2.7.3, has a vulnerability that allows an attacker to trigger a DAG in a GET request without CSRF validation. As a result, it was possible for a malicious website opened in the same browser - by the user who also had Airflow UI opened - to trigger the execution of DAGs without the user’s consent. Users are advised to upgrade to version 2.8.0 or later which is not affected

ghsa
#csrf#vulnerability#web#apache#git

Apache Airflow Cross-Site Request Forgery vulnerability

Moderate severity GitHub Reviewed Published Dec 21, 2023 to the GitHub Advisory Database • Updated Dec 21, 2023

ghsa: Latest News

GHSA-hxf5-99xg-86hw: cap-std doesn't fully sandbox all the Windows device filenames