CVE-2020-17515

2020-12-1114:15:11

Google

osv.dev

0.004 Low

EPSS

Percentile

74.4%

JSON

The “origin” parameter passed to some of the endpoints like ‘/trigger’ was vulnerable to XSS exploit. This issue affects Apache Airflow versions prior to 1.10.13. This is same as CVE-2020-13944 but the implemented fix in Airflow 1.10.13 did not fix the issue completely.

CPENameOperatorVersion
airfloweqproviders-oracle/2.0.1rc1
airfloweqproviders-exasol/2.0.1
airfloweqproviders-presto/2.0.0
airfloweqproviders-apache-pinot/2.0.1rc1
airfloweqproviders-alibaba/1.0.0
airfloweqproviders-tableau/2.1.1
airfloweqproviders-docker/2.1.0
airfloweqproviders-postgres/2.1.0rc1
airfloweqproviders-singularity/2.0.0
airfloweqproviders-yandex/2.1.0rc1

Name	Operator	Version
airflow	eq	providers-oracle/2.0.1rc1
airflow	eq	providers-exasol/2.0.1
airflow	eq	providers-presto/2.0.0
airflow	eq	providers-apache-pinot/2.0.1rc1
airflow	eq	providers-alibaba/1.0.0
airflow	eq	providers-tableau/2.1.1
airflow	eq	providers-docker/2.1.0
airflow	eq	providers-postgres/2.1.0rc1
airflow	eq	providers-singularity/2.0.0
airflow	eq	providers-yandex/2.1.0rc1