CVE-2017-17836 | BDVDB-2026-112115 Detail

ApacheApache Airflow

Description#

In Apache Airflow 1.8.2 and earlier, an experimental Airflow feature displayed authenticated cookies, as well as passwords to databases used by Airflow. An attacker who has limited access to airflow, whether it be via XSS or by leaving a machine unlocked can exfiltrate all credentials from the system.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://lists.apache.org/thread.html/ade4d54ebf614f68dc81a08891755e60ea58ba88e0209233eeea5f57%40%3Cdev.airflow.apache.org%3E

Exploit#

No public exploit known

History#

Version 12019-01-23Record published in the CVE List.
Version 22024-09-17Most recent update recorded in the CVE List.