Non notée
CVE-2020-13944 In Apache Airflow < 1.10.12, the "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to…
Description
In Apache Airflow < 1.10.12, the "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache Airflow | Versions non publiées |
Références
- lists.apache.org lists.apache.org
- [airflow-users] 20201211 CVE-2020-17515: Apache Airflow Reflected XSS via Origin Parameter lists.apache.org
- [airflow-dev] 20201211 Apache Airflow Security Vulnerabilities fixed in v1.10.13: CVE-2020-17515 lists.apache.org
- [airflow-users] 20201211 Apache Airflow Security Vulnerabilities fixed in v1.10.13: CVE-2020-17515 lists.apache.org
- [oss-security] 20201211 CVE-2020-17515: Apache Airflow Reflected XSS via Origin Parameter www.openwall.com
- [announce] 20201211 Apache Airflow Security Vulnerabilities fixed in v1.10.13: CVE-2020-17515 lists.apache.org
- [airflow-users] 20210501 CVE-2021-28359: Apache Airflow Reflected XSS via Origin Query Argument in URL lists.apache.org
- [oss-security] 20210501 CVE-2021-28359: Apache Airflow Reflected XSS via Origin Query Argument in URL www.openwall.com
- [announce] 20210501 Apache Airflow CVE: CVE-2021-28359: Apache Airflow Reflected XSS via Origin Query Argument in URL lists.apache.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de Apache Airflow
Les 5 CVE de Apache Airflow →
CVE-2020-13927
Apache Airflow's Experimental API Authentication Bypass
9.8
Critique
CVE-2019-12417
A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary…
Non notée
CVE-2019-0216
A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary…
Non notée
CVE-2019-0229
A number of HTTP endpoints in the Airflow webserver (both RBAC and classic) did not have adequate protection and were…
Non notée