GHSA-rjvg-q57v-mjjc

XSS in Apache Airflow

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-12398

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	apache-airflow	< 1.10.5	1.10.5

Details

As written in the advisory (Markdown source, shown as plain text).

In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. The new "RBAC" UI is unaffected.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-12398 advisory
https://github.com/apache/airflow package
https://github.com/apache/airflow/blob/1.10.5/CHANGELOG.txt web
https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2020-162.yaml web
https://lists.apache.org/thread.html/r72487ad6b23d18689896962782f8c93032afe5c72a6bfd23b253352b%40%3Cusers.airflow.apache.org%3E web
https://lists.apache.org/thread.html/r72487ad6b23d18689896962782f8c93032afe5c72a6bfd23b253352b@%3Cdev.airflow.apache.org%3E web
http://www.openwall.com/lists/oss-security/2020/01/14/2 web