PT-2020-12966 · Apache · Apache Airflow

Ali Al-Habsi · Published 2020-07-16 · Updated 2024-03-06 · CVE-2020-11983

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions 1.10.10 and below

Description An issue was discovered in the admin management screens of the new/RBAC UI, where escaping was handled incorrectly. This allowed authenticated users with appropriate permissions to create stored XSS attacks.

Recommendations For Apache Airflow versions 1.10.10 and below, consider updating to a version above 1.10.10 to resolve the issue. As a temporary workaround, restrict access to the admin management screens in the new/RBAC UI to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-AIRFLOW-2020-11983

CVE-2020-11983

GHSA-Q4P3-QW5C-MHPC

PYSEC-2020-17

Affected Products

Apache Airflow

References · 9

• https://lists.apache.org/thread.html/r7255cf0be3566f23a768e2a04b40fb09e52fcd1872695428ba9afe91%40%3Cusers.airflow.apache.org%3E · Vendor Advisory
• https://osv.dev/vulnerability/BIT-airflow-2020-11983 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2020-17 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-11983 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q4p3-qw5c-mhpc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11983 · Security Note
• https://github.com/apache/airflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2020-17.yaml · Note
• https://github.com/advisories/GHSA-q4p3-qw5c-mhpc · Note