Azkaban through 4.0.0 Authorization Bypass via ScheduleServlet
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.1epss 0.3%
exploitation probability
0.3%top 76% of all CVEs
observed exploitation
nono source reports it
Azkaban through 4.0.0 omits project permission checks in the ScheduleServlet fetchSchedule action, allowing authenticated users to read any project's schedule configuration. Attackers can supply arbitrary project and flow identifiers to retrieve sensitive schedule details including execution times, cron expressions, flow parameters, and notification email lists without proper authorization.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
azkaban · azkabanReferences
https://github.com/azkaban/azkabanhttps://github.com/azkaban/azkaban/blob/4.0.0/azkaban-web-server/src/main/java/azkaban/webapp/servlet/ScheduleServlet.java#L237-L262https://github.com/azkaban/azkaban/blob/4.0.0/azkaban-web-server/src/main/java/azkaban/webapp/servlet/ScheduleServlet.java#L403-L412https://github.com/azkaban/azkaban/issues/3348https://github.com/azkaban/azkaban/releases/tag/4.0.0https://www.vulncheck.com/advisories/azkaban-through-4.0.0-authorization-bypass-via-scheduleservlet