Advisoriesby IbisApache AirflowGHSA-65xw-pcqw-hjrh
Apache Airflow Cross-site Scripting Vulnerability
Fix: upgrade to 2.2.4rc1 or later
It was discovered that the "Trigger DAG with config" screen was susceptible to XSS attacks via the origin query argument. This issue affects Apache Airflow versions 2.2.3 and below.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| apache-airflow PyPI | < 2.2.4rc1 | 2.2.4rc1 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-79
- Also known as
- BIT-airflow-2021-45229, CVE-2021-45229, PYSEC-2022-29
- nvd.nist.gov/vuln/detail/CVE-2021-45229
- github.com/apache/airflow/commit/628aa1f99c865d97d0b1c7c76e630e43a7b8d319
- github.com/advisories/GHSA-65xw-pcqw-hjrh
- github.com/apache/airflow
- github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2022-29.yaml
- lists.apache.org/thread/phx76cgtmhwwdy780rvwhobx8qoy4bnk
More Apache Airflow advisories
All Apache Airflow
Apache Airflow exposes arbitrary file contentCVE-2022-38170fixed in 2.3.4Missing Authentication for Critical Function in Apache AirflowCVE-2021-38540fixed in 2.1.3Apache Airflow Reflected Cross-site Scripting vulnerability in 404 EndpointCVE-2017-12614fixed in 1.9.0OS Command injection in Apache AirflowCVE-2022-24288fixed in 2.2.4Improper Privilege Management in apache-airflowCVE-2021-45230fixed in 2.2.0Missing Authorization in Apache AirflowCVE-2021-35936fixed in 2.1.2