PT-2023-22222 · Apache · Apache Airflow

Kuteminh11 + 1 · Published 2023-05-08 · Updated 2024-03-06 · CVE-2023-29247

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 2.6.0

Description The task instance details page in the UI is vulnerable to a stored cross-site scripting (XSS) issue. This allows for malicious scripts to be stored and executed on the page.

Recommendations For versions prior to 2.6.0, update to version 2.6.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the task instance details page in the UI until a patch is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-AIRFLOW-2023-29247

CVE-2023-29247

GHSA-VCF6-3WV2-5VCR

PYSEC-2023-60

Affected Products

Apache Airflow

References · 15

• https://github.com/apache/airflow/pull/30779 · Patch
• https://github.com/apache/airflow/pull/30447 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-29247 · Security Note
• https://osv.dev/vulnerability/CVE-2023-29247 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vcf6-3wv2-5vcr · Vendor Advisory
• https://lists.apache.org/thread/kqf5lxmko133780clsp827xfsh4xd3fl · Vendor Advisory
• https://osv.dev/vulnerability/BIT-airflow-2023-29247 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2023-60 · Vendor Advisory
• https://github.com/apache/airflow · Note
• https://github.com/apache/airflow/commit/f819dfcb24c597058b7b671f6317e4c84976975e · Note
• https://github.com/apache/airflow/commit/46c85ec11d224c133da6c45c1186c9aa498a7e75 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-60.yaml · Note
• https://t.me/cvenotify/49928 · Telegram Post
• https://t.me/cibsecurity/63413 · Telegram Post
• https://github.com/advisories/GHSA-vcf6-3wv2-5vcr · Note