GHSA-rv25-9wgj-xg75

Apache Airflow Reflected Cross-site Scripting vulnerability in 404 Endpoint

Source: GitHub Advisory Database (reviewed) Moderate CVE-2017-12614

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	apache-airflow	< 1.9.0	1.9.0

Details

As written in the advisory (Markdown source, shown as plain text).

It was noticed an XSS in certain 404 pages that could be exploited to perform an XSS attack. Chrome will detect this as a reflected XSS attempt and prevent the page from loading. However Firefox and other browsers don't, and are vulnerable to this attack. Mitigation: The fix for this is to upgrade to Apache Airflow 1.9.0 or above.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2017-12614 advisory
https://github.com/apache/airflow/commit/e1a2d74c0045c9231f7a5365c956b8e048dd6af3 web
https://devhub.checkmarx.com/cve-details/cve-2017-12614 web
https://github.com/apache/airflow package
https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2018-45.yaml web
https://lists.apache.org/thread.html/2c72480c76619c5e7793f0d213c34082f0598eaa4d212172f068940f@%3Cdev.airflow.apache.org%3E web