Advisoriesby IbisApache AirflowGHSA-9gqg-3fxr-9hv7
Apache Airflow vulnerable to XSS
Fix: upgrade to 1.9.0 or later
In Apache Airflow 1.8.2 and earlier, an experimental Airflow feature displayed authenticated cookies, as well as passwords to databases used by Airflow. An attacker who has limited access to airflow, weather it be via XSS or by leaving a machine unlocked can exfil all credentials from the system.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| apache-airflow PyPI | < 1.9.0 | 1.9.0 |
Details and references
- CVSS 3.0
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-79
- Also known as
- CVE-2017-17836, PYSEC-2019-149
- nvd.nist.gov/vuln/detail/CVE-2017-17836
- github.com/advisories/GHSA-9gqg-3fxr-9hv7
- github.com/apache/airflow
- github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2019-149.yaml
- lists.apache.org/thread.html/ade4d54ebf614f68dc81a08891755e60ea58ba88e0209233eeea5f57@%3Cdev.airflow.apache.org%3E
More Apache Airflow advisories
All Apache Airflow
Apache Airflow vulnerable to CSRF AttacksCVE-2019-0229fixed in 1.10.3Apache Airflow vulnerable to Stored XSSCVE-2019-0216fixed in 1.10.3Apache Airflow vulnerable to Stored XSSCVE-2018-20244fixed in 1.10.2Improper Certificate Validation in Apache AirflowCVE-2018-20245fixed in 1.10.1Cross-Site Request Forgery (CSRF) in Apache AirflowCVE-2017-17835fixed in 1.9.0Improper Input Validation in Apache Airflow resulting in Remote Code ExecutionCVE-2017-15720fixed in 1.9.0