Non notée
CVE-2019-12398 In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the state of…
Description
In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. The new "RBAC" UI is unaffected.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Airflow | Versions non publiées |
Références
- [airflow-dev] 20200114 [CVE-2019-12398] Apache Airflow Stored XSS vulnerability in classic UI lists.apache.org
- [oss-security] 20200114 [CVE-2019-12398] Apache Airflow Stored XSS vulnerability in classic UI www.openwall.com
- [airflow-users] 20200114 [CVE-2019-12398] Apache Airflow Stored XSS vulnerability in classic UI lists.apache.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de Airflow
Les 13 CVE de Airflow →
CVE-2024-45784
Apache Airflow versions before 2.10.3 contain a vulnerability that could expose sensitive configuration variables in…
Non notée
CVE-2024-45034
Apache Airflow versions before 2.10.1 have a vulnerability that allows DAG authors to add local settings to the DAG…
Non notée
CVE-2024-45498
Example DAG: example_inlet_event_extra.py shipped with Apache Airflow version 2.10.0 has a vulnerability that allows…
Non notée
CVE-2024-39877
Apache Airflow: DAG Author Code Execution possibility in airflow-scheduler
Non notée