Not rated
CVE-2019-12417 A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary…
Description
A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. This also presented a Local File Disclosure vulnerability to any file readable by the webserver process.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Airflow | Versions not published |
Other CVEs of Apache Airflow
The 5 CVEs of Apache Airflow →
CVE-2020-13927
Apache Airflow's Experimental API Authentication Bypass
9.8
Critical
CVE-2020-13944
In Apache Airflow < 1.10.12, the "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to…
Not rated
CVE-2019-0216
A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary…
Not rated
CVE-2019-0229
A number of HTTP endpoints in the Airflow webserver (both RBAC and classic) did not have adequate protection and were…
Not rated