logo

Database

Server side cross-site scripting In apache-airflow

Description

Apache Airflow vulnerable to stored Cross-site Scripting Task instance details page in the UI is vulnerable to stored cross-site scripting. This issue affects Apache Airflow before 2.6.0.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2023-292472. NVD-2023-292473. OSV-2023-292474. GCVE-2023-29247

References

1. https://github.com/apache/airflow/pull/304472. https://github.com/apache/airflow/pull/307793. https://github.com/apache/airflow/commit/46c85ec11d224c133da6c45c1186c9aa498a7e754. https://github.com/apache/airflow/commit/f819dfcb24c597058b7b671f6317e4c84976975e5. https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-60.yaml6. https://lists.apache.org/thread/kqf5lxmko133780clsp827xfsh4xd3fl

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.