Description
A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. This also presented a Local File Disclosure vulnerability to any file readable by the webserver process.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Apache Airflow | Apache Airflow up to 1.10.5 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | airflow | < 1.10.6 | 1.10.6 | GHSA-q3p4-gw7r-wqjc |
| PyPI | apache-airflow | < 1.10.6rc1 | 1.10.6rc1 | PYSEC-2019-216 |