GHSA-99cv-8cvv-666c

Apache Airflow vulnerable to Stored XSS

Source: GitHub Advisory Database (reviewed) Moderate CVE-2018-20244

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	apache-airflow	< 1.10.2	1.10.2

Details

As written in the advisory (Markdown source, shown as plain text).

In Apache Airflow before 1.10.2, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-20244 advisory
https://github.com/apache/airflow/commit/27a4a888e946728d9bb33b78ec604e08d4a93f89 web
https://github.com/apache/airflow/commit/3ff94c7da60fbb24bf99eb6192c7386e8ab4c4c9 web
https://github.com/advisories/GHSA-99cv-8cvv-666c advisory
https://github.com/apache/airflow package
https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2019-142.yaml web
https://lists.apache.org/thread.html/2de387213d45bc626d27554a1bde7b8c67d08720901f82a50b6f4231@%3Cdev.airflow.apache.org%3E web
https://lists.apache.org/thread.html/f656fddf9c49293b3ec450437c46709eb01a12d1645136b2f1b8573b@%3Cdev.airflow.apache.org%3E web
http://www.openwall.com/lists/oss-security/2019/04/10/6 web