PT-2024-29645 · Apache · Apache Airflow

Amogh Desai + 1 · Published 2024-08-21 · Updated 2024-09-07 · CVE-2024-41937

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 2.10.0

Description The issue allows the developer of a malicious provider to execute a cross-site scripting attack when clicking on a provider documentation link. This requires the provider to be installed on the web server and the user to click the provider link.

Recommendations For Apache Airflow versions prior to 2.10.0, upgrade to 2.10.0 or later, which fixes this issue. As a temporary workaround, consider restricting access to provider documentation links to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-AIRFLOW-2024-41937

CVE-2024-41937

GHSA-W7CP-G8V7-R54M

PYSEC-2024-181

Affected Products

Apache Airflow

References · 19

• https://github.com/apache/airflow/pull/40933 · Patch
• https://lists.apache.org/thread/lwlmgg6hqfmkpvw5py4w53hxyl37jl6d · Vendor Advisory
• https://osv.dev/vulnerability/BIT-airflow-2024-41937 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2024-181 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w7cp-g8v7-r54m · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-41937 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-41937 · Security Note
• https://github.com/apache/airflow · Note
• https://github.com/apache/airflow/commit/f1852c2ab28b155e196569780013fbb61a4a1f98 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2024-181.yaml · Note
• https://twitter.com/oss_security/status/1826275437003300930 · Twitter Post
• https://twitter.com/CVEnew/status/1826282948846346313 · Twitter Post
• https://t.me/cvedetector/3793 · Telegram Post
• https://twitter.com/bountywriteups/status/1832331162557022317 · Twitter Post
• http://openwall.com/lists/oss-security/2024/08/21/3 · Note