GHSA-65xw-pcqw-hjrh

Apache Airflow Cross-site Scripting Vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-45229

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	apache-airflow	< 2.2.4rc1	2.2.4rc1

Details

As written in the advisory (Markdown source, shown as plain text).

It was discovered that the "Trigger DAG with config" screen was susceptible to XSS attacks via the `origin` query argument. This issue affects Apache Airflow versions 2.2.3 and below.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-45229 advisory
https://github.com/apache/airflow/commit/628aa1f99c865d97d0b1c7c76e630e43a7b8d319 web
https://github.com/advisories/GHSA-65xw-pcqw-hjrh advisory
https://github.com/apache/airflow package
https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2022-29.yaml web
https://lists.apache.org/thread/phx76cgtmhwwdy780rvwhobx8qoy4bnk web