PT-2019-11196 · Apache · Airflow

Published 2019-01-23 · Updated 2019-04-12 · CVE-2019-0216

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Airflow (affected versions not specified)

Description: A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

XSS

Weakness Enumeration

CWE-284

CWE-79

Related Identifiers

BDU:2019-04409

CVE-2019-0216

GHSA-8P7V-2JVJ-V54R

PYSEC-2019-214

Affected Products

Airflow

References · 25

• https://lists.fedoraproject.org/archives/list/[e-mail]/message/EZRMTEIGZKYFNGIDOTXN3GNEJTLVCYU7 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8p7v-2jvj-v54r · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-04409 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-0216 · Security Note
• https://osv.dev/vulnerability/PYSEC-2019-214 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/ALIR5S3O7NRHEGFMIDMUSYQIZOE4TJJN · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-0216 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/WETXNQWNQLWHV6XNW6YTO5UGDTIWAQGT · Vendor Advisory
• https://github.com/apache/airflow · Note
• https://github.com/apache/airflow/commit/73280e489c8a766264f2dd9225c3c899f31be758 · Note
• https://github.com/apache/airflow/commit/a7d8fe64a15b9c228654441166a5ba85d0a5f8ef · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2019-214.yaml · Note
• https://abf.rosa.ru/advisories/ROSA-SA-2025-2899 · Note
• http://securityfocus.com/bid/107869 · Note
• http://openwall.com/lists/oss-security/2019/04/10/6 · Note