Not rated
CVE-2019-12398 In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the state of…
Description
In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. The new "RBAC" UI is unaffected.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Airflow | Versions not published |
References
- [airflow-dev] 20200114 [CVE-2019-12398] Apache Airflow Stored XSS vulnerability in classic UI lists.apache.org
- [oss-security] 20200114 [CVE-2019-12398] Apache Airflow Stored XSS vulnerability in classic UI www.openwall.com
- [airflow-users] 20200114 [CVE-2019-12398] Apache Airflow Stored XSS vulnerability in classic UI lists.apache.org
Timeline
- Published
- Last modified
Other CVEs of Airflow
The 13 CVEs of Airflow →
CVE-2024-45784
Apache Airflow versions before 2.10.3 contain a vulnerability that could expose sensitive configuration variables in…
Not rated
CVE-2024-45034
Apache Airflow versions before 2.10.1 have a vulnerability that allows DAG authors to add local settings to the DAG…
Not rated
CVE-2024-45498
Example DAG: example_inlet_event_extra.py shipped with Apache Airflow version 2.10.0 has a vulnerability that allows…
Not rated
CVE-2024-39877
Apache Airflow: DAG Author Code Execution possibility in airflow-scheduler
Not rated