Skip to content
fr Sign in
Not rated

CVE-2019-12417 A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary…

Description

A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. This also presented a Local File Disclosure vulnerability to any file readable by the webserver process.

Affected products and versions

Product Affected versions Fixed in
Apache Airflow Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Apache Airflow

The 5 CVEs of Apache Airflow →
CVE-2020-13927 Apache Airflow's Experimental API Authentication Bypass 9.8 Critical CVE-2020-13944 In Apache Airflow < 1.10.12, the "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to… Not rated CVE-2019-0216 A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary… Not rated CVE-2019-0229 A number of HTTP endpoints in the Airflow webserver (both RBAC and classic) did not have adequate protection and were… Not rated
Track this CVE