PT-2023-22222 · Apache · Apache Airflow

Kuteminh11 + 1 · Publicado 2023-05-08 · Atualizado 2024-03-06 · CVE-2023-29247

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 2.6.0

Description The task instance details page in the UI is vulnerable to a stored cross-site scripting (XSS) issue. This allows for malicious scripts to be stored and executed on the page.

Recommendations For versions prior to 2.6.0, update to version 2.6.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the task instance details page in the UI until a patch is applied.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BIT-AIRFLOW-2023-29247

CVE-2023-29247

GHSA-VCF6-3WV2-5VCR

PYSEC-2023-60

Produtos afetados

Apache Airflow

Referências · 15

• https://github.com/apache/airflow · Nota
• https://github.com/apache/airflow/pull/30779 · Correção
• https://github.com/apache/airflow/pull/30447 · Correção
• https://github.com/apache/airflow/commit/f819dfcb24c597058b7b671f6317e4c84976975e · Nota
• https://github.com/apache/airflow/commit/46c85ec11d224c133da6c45c1186c9aa498a7e75 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-60.yaml · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-29247 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-29247 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-vcf6-3wv2-5vcr · Aviso do Fabricante
• https://t.me/cvenotify/49928 · Publicação no Telegram
• https://lists.apache.org/thread/kqf5lxmko133780clsp827xfsh4xd3fl · Aviso do Fabricante
• https://t.me/cibsecurity/63413 · Publicação no Telegram
• https://osv.dev/vulnerability/BIT-airflow-2023-29247 · Aviso do Fabricante
• https://github.com/advisories/GHSA-vcf6-3wv2-5vcr · Nota
• https://osv.dev/vulnerability/PYSEC-2023-60 · Aviso do Fabricante