Medium · 5.5 CVE-2018-20244 EUVD-2019-0010GHSA-99cv-8cvv-666cPYSEC-2019-142

Apache Airflow vulnerable to Stored XSS

Published Feb 27, 2019 · Updated Sep 16, 2024 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Airflow Package: apache-airflow Ecosystem: PyPI

Description

In Apache Airflow before 1.10.2, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views.

Affected products

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache Airflow	Apache Airflow <= 1.10.1	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
PyPI	apache-airflow	< 1.10.2	1.10.2	GHSA-99cv-8cvv-666c

References

https://lists.apache.org/thread.html/f656fddf9c49293b3ec450437c46709eb01a12d1645136b2f1b8573b%40%3Cdev.airflow.apache.org%3E
[airflow-dev] 20190410 CVE-2019-0216, CVE-2019-0229 vulnerabilities affecting Apache Airflow <= 1.10.2 webserver component mailing-list
[oss-security] 20190410 CVE-2019-0216, CVE-2019-0229 vulnerabilities affecting Apache Airflow <= 1.10.2 webserver component mailing-list