What is GHSA-6r3p-fcvm-xh7c?

GHSA-6r3p-fcvm-xh7c is a security advisory published by GitHub Security Advisories with Medium severity. SSRF vulnerability in Apache Airflow

Which CVE IDs does GHSA-6r3p-fcvm-xh7c cover?

GHSA-6r3p-fcvm-xh7c covers the following CVE IDs: CVE-2020-17513. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-6r3p-fcvm-xh7c?

GHSA-6r3p-fcvm-xh7c has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

Which products are affected by GHSA-6r3p-fcvm-xh7c?

GHSA-6r3p-fcvm-xh7c affects 1 product, including: pip/apache-airflow:\u003c 1.10.13.

GHSA-6r3p-fcvm-xh7cMediumCVSS 5.3

SSRF vulnerability in Apache Airflow

Vendor

GitHub Security Advisories

Published

December 17, 2020

Last Modified

September 11, 2024

🔗 CVE IDs covered (1)

CVE-2020-17513 →

📋 Description

In Apache Airflow versions prior to 1.10.13, the Charts and Query View of the old (Flask-admin based) UI were vulnerable for SSRF attack.

🎯 Affected products1

pip/apache-airflow:< 1.10.13

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2020-17513
https://lists.apache.org/thread.html/rb3647269f07cc2775ca6568cbfd4994d862c842a58120d2aba9c658a%40%3Cusers.airflow.apache.org%3E
https://github.com/apache/airflow/commit/b606b871226d649913a37fd074eeae5d86ebc3a1
https://github.com/advisories/GHSA-6r3p-fcvm-xh7c
https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2020-20.yaml