CVE-2020-11981

Description

An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect to the broker (Redis, RabbitMQ) directly, it is possible to inject commands, resulting in the celery worker running arbitrary commands.

Risk Information

Base Score

9.8

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

91.588

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2020-11978,CVE-2020-11981 are fixed in Python-apache-airflow 1.10.11rc1	Windows
Vulnerabilities CVE-2020-11978,CVE-2020-11981 are fixed in Python-apache-airflow for linux 1.10.11rc1	Linux
Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) Vulnerability (CVE-2020-11981)	NCM

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234