PT-2020-9308 · Apache · Apache Airflow

Venkat · Published 2020-01-14 · Updated 2020-05-06 · CVE-2019-12398

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 1.10.5

Description A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views when running with the classic UI. The new RBAC UI is unaffected.

Recommendations For versions prior to 1.10.5, update to version 1.10.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the classic UI until the update is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-12398

GHSA-RJVG-Q57V-MJJC

PYSEC-2020-162

Affected Products

Apache Airflow

References · 12

• https://lists.apache.org/thread.html/r72487ad6b23d18689896962782f8c93032afe5c72a6bfd23b253352b%40%3Cusers.airflow.apache.org%3E · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12398 · Security Note
• https://osv.dev/vulnerability/CVE-2019-12398 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2020-162 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rjvg-q57v-mjjc · Vendor Advisory
• https://github.com/apache/airflow · Note
• https://github.com/apache/airflow/blob/1.10.5/CHANGELOG.txt · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2020-162.yaml · Note
• https://lists.apache.org/thread.html/r72487ad6b23d18689896962782f8c93032afe5c72a6bfd23b253352b@%3Cdev.airflow.apache.org%3E · Note
• https://lists.apache.org/thread.html/r72487ad6b23d18689896962782f8c93032afe5c72a6bfd23b253352b%40%3Cdev.airflow.apache.org%3E · Note
• https://github.com/advisories/GHSA-rjvg-q57v-mjjc · Note
• http://openwall.com/lists/oss-security/2020/01/14/2 · Note