GitHub Advisoryadvisory · PyPI

GHSA-4pwq-fj89-6rjc Apache Airflow Cross-site Scripting

MEDIUM Published 2021-06-18 Modified 2024-09-11 Official page ↗
Aliases
CVE-2020-13944
Ecosystem
PyPI
Packages
apache-airflow
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2021-05-03

Affected packages

• PyPI apache-airflow: < 1.10.12 → fixed in 1.10.12

Description

In Apache Airflow < 1.10.12, the `origin` parameter passed to some of the endpoints like `/trigger` and was vulnerable to a XSS exploit.

Related

Alias · CVE (1)

  • CVE-2020-13944 In Apache Airflow < 1.10.12, the "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References