Lucene search
GoogleOSV:GHSA-9GQG-3FXR-9HV7HistoryJan 25, 2019 - 4:19 p.m.
Apache Airflow vulnerable to XSS
2019-01-2516:19:09
Google
osv.dev
11
In Apache Airflow 1.8.2 and earlier, an experimental Airflow feature displayed authenticated cookies, as well as passwords to databases used by Airflow. An attacker who has limited access to airflow, weather it be via XSS or by leaving a machine unlocked can exfil all credentials from the system.
| CPE | Name | Operator | Version |
|---|---|---|---|
| apache-airflow | eq | 1.8.2rc1 | |
| apache-airflow | eq | 1.8.1 | |
| apache-airflow | eq | 1.8.2 |
Related
cvelist
cvelist
CVE-2017-17836
2019-01-08 00:00:00
osv
osv
PYSEC-2019-149
2019-01-23 17:29:00
CVE-2017-17836
2019-01-23 17:29:00
prion
prion
Design/Logic Flaw
2019-01-23 17:29:00
nvd
nvd
CVE-2017-17836
2019-01-23 17:29:00
cve
cve
CVE-2017-17836
2019-01-23 17:29:00
github
github
Apache Airflow vulnerable to XSS
2019-01-25 16:19:09