Описание
The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions prior to 1.10.13. This is same as CVE-2020-13944 but the implemented fix in Airflow 1.10.13 did not fix the issue completely.
Ссылки
- Mailing ListVendor Advisory
- Mailing ListThird Party Advisory
- Issue TrackingMailing ListVendor Advisory
- Issue TrackingMailing ListVendor Advisory
- Mailing ListVendor Advisory
- Mailing ListThird Party Advisory
- Issue TrackingMailing ListVendor Advisory
- Issue TrackingMailing ListVendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 1.10.15 (исключая)Версия от 2.0.0 (включая) до 2.0.2 (исключая)
Одно из
cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*
EPSS
Процентиль: 93%
0.10185
Средний
6.1 Medium
CVSS3
4.3 Medium
CVSS2
Дефекты
CWE-79
Связанные уязвимости
CVSS3: 6.1
debian
около 5 лет назад
The "origin" parameter passed to some of the endpoints like '/trigger' ...
CVSS3: 6.1
github
почти 5 лет назад
Apache Airflow cross-site scripting due to incomplete fix for CVE-2020-13944
EPSS
Процентиль: 93%
0.10185
Средний
6.1 Medium
CVSS3
4.3 Medium
CVSS2
Дефекты
CWE-79