Not rated
CVE-2019-0216 A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary…
Description
A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Airflow | Versions not published |
References
- lists.apache.org lists.apache.org
- [oss-security] 20190410 CVE-2019-0216, CVE-2019-0229 vulnerabilities affecting Apache Airflow <= 1.10.2 webserver component www.openwall.com
- 107869 www.securityfocus.com
Timeline
- Published
- Last modified
Other CVEs of Apache Airflow
The 5 CVEs of Apache Airflow →
CVE-2020-13927
Apache Airflow's Experimental API Authentication Bypass
9.8
Critical
CVE-2020-13944
In Apache Airflow < 1.10.12, the "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to…
Not rated
CVE-2019-12417
A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary…
Not rated
CVE-2019-0229
A number of HTTP endpoints in the Airflow webserver (both RBAC and classic) did not have adequate protection and were…
Not rated