Description
The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions prior to 1.10.13. This is same as CVE-2020-13944 but the implemented fix in Airflow 1.10.13 did not fix the issue completely.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Airflow | Apache Airflow – < 1.10.13 | 1.10.13 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | apache-airflow | < 1.10.15rc1 | 1.10.15rc1 | GHSA-86vp-x3pr-79rx |
| PyPI | apache-airflow | >= 2.0.0b1, < 2.0.2rc1 | 2.0.2rc1 | GHSA-86vp-x3pr-79rx |
| PyPI | apache-airflow | < 1.10.13 | 1.10.13 | PYSEC-2020-21 |
Advisories 1
- WID-SEC-2022-0184 Fortinet FortiAnalyzer: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 9, 2026
References
- https://lists.apache.org/thread.html/r4656959c8ed06c1f6202d89aa4e67b35ad7bdba5a666caff3fea888e%40%3Cusers.airflow.apache.org%3E
- [airflow-dev] 20201211 Apache Airflow Security Vulnerabilities fixed in v1.10.13: CVE-2020-17515 mailing-list
- [airflow-users] 20201211 Apache Airflow Security Vulnerabilities fixed in v1.10.13: CVE-2020-17515 mailing-list
- [oss-security] 20201211 CVE-2020-17515: Apache Airflow Reflected XSS via Origin Parameter mailing-list
- [announce] 20201211 Apache Airflow Security Vulnerabilities fixed in v1.10.13: CVE-2020-17515 mailing-list
- [airflow-users] 20210501 CVE-2021-28359: Apache Airflow Reflected XSS via Origin Query Argument in URL mailing-list
- [oss-security] 20210501 CVE-2021-28359: Apache Airflow Reflected XSS via Origin Query Argument in URL mailing-list
- [announce] 20210501 Apache Airflow CVE: CVE-2021-28359: Apache Airflow Reflected XSS via Origin Query Argument in URL mailing-list