Description
An issue was found in Apache Airflow versions 1.10.10 and below. It was discovered that many of the admin management screens in the new/RBAC UI handled escaping incorrectly, allowing authenticated users with appropriate permissions to create stored XSS attacks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Airflow | 1.10.10 and below | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | apache-airflow | < 1.10.11 | 1.10.11 | GHSA-q4p3-qw5c-mhpc |
| PyPI | apache-airflow | < 1.10.11rc1 | 1.10.11rc1 | PYSEC-2020-17 |