CVE-2020-13927

Advisory

Affected versions of the Apache Airflow package are vulnerable to Missing Authentication for Critical Function due to an insecure default configuration that permits unauthenticated requests to the Experimental API. In versions before 1.10.11, the web server exposes endpoints under /api/experimental/ without enforcing an authentication backend, allowing arbitrary clients to invoke operations such as POST /api/experimental/dags/<dag_id>/dag_runs.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://nvd.nist.gov/vuln/detail/CVE-2020-13927
• https://github.com/advisories/GHSA-hhx9-p69v-cx2j
• https://lists.apache.org/thread.html/r23a81b247aa346ff193670be565b2b8ea4b17ddbc7a35fc099c1aadd%40%3C
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13927
• https://lists.apache.org/thread.html/r23a81b247aa346ff193670be565b2b8ea4b17ddbc7a35fc099c1aadd%40%3Cdev.airflow.apache.org%3E
• http://packetstormsecurity.com/files/162908/Apache-Airflow-1.10.10-Remote-Code-Execution.html
• http://packetstormsecurity.com/files/174764/Apache-Airflow-1.10.10-Remote-Code-Execution.html