Azkaban
Monthly
Azkaban through 4.0.0 fails to enforce project-level permission checks in the ScheduleServlet fetchSchedule action, letting any authenticated user read the scheduling configuration of projects they do not own or have rights to. A logged-in attacker who supplies arbitrary project and flow identifiers can retrieve execution times, cron expressions, flow parameters, and notification email lists belonging to other teams. This is a read-only confidentiality exposure (CWE-862 missing authorization) with no code execution or data modification, exploitation requires a valid account (CVSS 3.1 PR:L), and no public exploit code or CISA KEV active-exploitation listing was identified at time of analysis.
Azkaban through 3.84.0 allows XXE, related to validator/XmlValidatorManager.java and user/XmlUserManager.java. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Azkaban through 4.0.0 fails to enforce project-level permission checks in the ScheduleServlet fetchSchedule action, letting any authenticated user read the scheduling configuration of projects they do not own or have rights to. A logged-in attacker who supplies arbitrary project and flow identifiers can retrieve execution times, cron expressions, flow parameters, and notification email lists belonging to other teams. This is a read-only confidentiality exposure (CWE-862 missing authorization) with no code execution or data modification, exploitation requires a valid account (CVSS 3.1 PR:L), and no public exploit code or CISA KEV active-exploitation listing was identified at time of analysis.
Azkaban through 3.84.0 allows XXE, related to validator/XmlValidatorManager.java and user/XmlUserManager.java. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.