GitHub Advisoryadvisory · PyPI

GHSA-q4p3-qw5c-mhpc Multiple stored XSS in RBAC Admin screens in Apache Airflow

MEDIUM Published 2020-07-27 Modified 2024-09-11 Official page ↗
Aliases
CVE-2020-11983
Ecosystem
PyPI
Packages
apache-airflow
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2020-07-27

Affected packages

• PyPI apache-airflow: < 1.10.11 → fixed in 1.10.11

Description

An issue was found in Apache Airflow versions 1.10.10 and below. It was discovered that many of the admin management screens in the new/RBAC UI handled escaping incorrectly, allowing authenticated users with appropriate permissions to create stored XSS attacks.

Related

Alias · CVE (1)

  • CVE-2020-11983 An issue was found in Apache Airflow versions 1.10.10 and below. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References