Advisoriesby IbisApache AirflowGHSA-w7cp-g8v7-r54m
Apache Airflow Cross-site Scripting Vulnerability
Fix: upgrade to 2.10.0 or later
Apache Airflow, versions before 2.10.0, have a vulnerability that allows the developer of a malicious provider to execute a cross-site scripting attack when clicking on a provider documentation link. This would require the provider to be installed on the web server and the user to click the provider link.
Users should upgrade to 2.10.0 or later, which fixes this vulnerability.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| apache-airflow PyPI | < 2.10.0 | 2.10.0 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-79
- Also known as
- BIT-airflow-2024-41937, CVE-2024-41937, PYSEC-2024-181
- nvd.nist.gov/vuln/detail/CVE-2024-41937
- github.com/apache/airflow/pull/40933
- github.com/apache/airflow/commit/f1852c2ab28b155e196569780013fbb61a4a1f98
- github.com/apache/airflow
- github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2024-181.yaml
- lists.apache.org/thread/lwlmgg6hqfmkpvw5py4w53hxyl37jl6d
- www.openwall.com/lists/oss-security/2024/08/21/3
More Apache Airflow advisories
All Apache Airflow
Apache Airflow vulnerable to Improper Encoding or Escaping of OutputCVE-2024-45498fixed in 2.10.1Apache Airflow vulnerable to Execution with Unnecessary PrivilegesCVE-2024-45034fixed in 2.10.1Insufficient Session Expiration vulnerability in Apache Airflow Providers FABCVE-2024-42447no fix yetApache Airflow has DAG Author Code Execution possibility in airflow-schedulerCVE-2024-39877fixed in 2.9.3Apache Airflow Potential Cross-site Scripting VulnerabilityCVE-2024-39863fixed in 2.9.3Apache Airflow does not return the "Cache-Control" header for dynamic contentCVE-2024-25142fixed in 2.9.2