Lucene search

GitHub Advisory DatabaseGHSA-52GM-QMG3-R4QP

HistoryMay 14, 2024 - 6:31 p.m.

Apache Airflow: XSS vulnerability in Task Instance Log/Log Details

2024-05-1418:31:00

CWE-79

GitHub Advisory Database

github.com

apache airflow

xss

vulnerability

task instance log

log details

upgrade

version 2.9.1

AI Score

6.5

Confidence

High

EPSS

Percentile

15.5%

JSON

Apache Airflow version 2.9.0 has a vulnerability that allows an authenticated attacker to inject malicious data into the task instance logs.
Users are recommended to upgrade to version 2.9.1, which fixes this issue.

Affected configurations

Vulners

Node

apacheairflowMatch2.9.0

VendorProductVersionCPE
apacheairflow2.9.0cpe:2.3:a:apache:airflow:2.9.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
apache	airflow	2.9.0	cpe:2.3:a:apache:airflow:2.9.0:::::::*

References

www.openwall.com/lists/oss-security/2024/05/14/1

github.com/advisories/GHSA-52gm-qmg3-r4qp

github.com/apache/airflow/commit/87acf61f574daf47ce9e03a986e352a2c727f4ce

github.com/apache/airflow/pull/38882

lists.apache.org/thread/gsjmnrqb3m5fzp0vgpty1jxcywo91v77

nvd.nist.gov/vuln/detail/CVE-2024-32077