logo

Database

Reflected cross-site scripting (XSS) In apache-airflow

Description

Apache Airflow cross-site scripting due to incomplete fix for CVE-2020-13944 The origin parameter passed to some of the endpoints like /trigger was vulnerable to XSS exploit. This issue affects Apache Airflow versions prior to 1.10.15. This is same as CVE-2020-13944 but the implemented fix in Airflow 1.10.13 did not fix the issue completely.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2020-175152. NVD-2020-175153. OSV-2020-175154. GHSA-86vp-x3pr-79rx5. GCVE-2020-17515

References

1. https://github.com/apache/airflow/pull/147382. https://github.com/apache/airflow/commit/13336272e32872247fa7d17e964ccd88ec8d13763. https://github.com/apache/airflow/commit/409c249121bd9c8902fc2ba551b21873ab41f9534. https://github.com/apache/airflow/commit/7486153f451e4d2bb1c6fd9cbb5a63430157c99c5. https://github.com/apache/airflow/commit/ab8c55878e3e4257d2276226cb17b047ba8566866. https://github.com/apache/airflow/commit/c6369beed53d41c0a70415b0d958bf0604124ad77. https://pypi.org/project/apache-airflow8. https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E9. https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E10. https://lists.apache.org/thread.html/r4656959c8ed06c1f6202d89aa4e67b35ad7bdba5a666caff3fea888e@%3Cusers.airflow.apache.org%3E11. https://lists.apache.org/thread.html/r4656959c8ed06c1f6202d89aa4e67b35ad7bdba5a666caff3fea888e%40%3Cusers.airflow.apache.org%3E12. https://lists.apache.org/thread.html/r2892ef594dbbf54d0939b808626f52f7c2d1584f8aa1d81570847d2a@%3Cusers.airflow.apache.org%3E13. https://lists.apache.org/thread.html/r2892ef594dbbf54d0939b808626f52f7c2d1584f8aa1d81570847d2a@%3Cdev.airflow.apache.org%3E14. https://lists.apache.org/thread.html/r2892ef594dbbf54d0939b808626f52f7c2d1584f8aa1d81570847d2a@%3Cannounce.apache.org%3E15. https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2020-21.yaml16. https://github.com/apache/airflow/releases/tag/2.0.217. https://github.com/apache/airflow/releases/tag/1.10.1518. http://www.openwall.com/lists/oss-security/2020/12/11/219. http://www.openwall.com/lists/oss-security/2021/05/01/2

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.