BIT-AIRFLOW-2021-28359 Apache Airflow Reflected XSS via Origin Query Argument in URL

The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions 1.10.15 in 1.x series and affects 2.0.0 and 2.0.1 and 2.x series. This is the same as CVE-2020-13944 & CVE-2020-17515 but the implemented fix did not fi...

Cross-site Scripting in Apache Airflow

The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions 1.10.15 in 1.x series and affects 2.0.0 and 2.0.1 and 2.x series. This is the same as CVE-2020-13944 & CVE-2020-17515 but the implemented fix did not fi...

Cross-Site Scripting (XSS)

apacheairflow is vulnerable to cross-site scripting XSS. The vulnerability exists due to an incomplete fix of CVE-2020-17515, where the origin parameter passed to some endpoints were not sanitized...

airflow-clickhouse-plugin (>=0.5.1, <=0.5.3), airflow-docker (>=0.1.1, <=1.1.0) +29 more potentially affected by CVE-2020-17515 via apache-airflow (>=1.8.2, <=1.10.14)

apache-airflow PYPI version =1.8.2, =0.5.1, =0.1.1, =2.4.2, =1.0.1, =1.2.1, =0.0.1.post1, =0.1.3a0, =0.4.0rc2, =1.7.2, =0.1.0, =0.0.1, =0.24.11, =0.25.15 and more Source cves: CVE-2020-17515 Source advisory: OSV:GHSA-86VP-X3PR-79RX...

airflow-clickhouse-plugin (>=0.5.1, <=0.5.3), airflow-docker (>=0.1.1, <=1.1.0) +29 more potentially affected by CVE-2020-13944 +1 more via apache-airflow (>=1.8.2, <=1.10.14)

apache-airflow PYPI version =1.8.2, =0.5.1, =0.1.1, =2.4.2, =1.0.1, =1.2.1, =0.0.1.post1, =0.1.3a0, =0.4.0rc2, =1.7.2, =0.1.0, =0.0.1, =0.24.11, =0.25.15 and more Source cves: CVE-2020-13944, CVE-2020-17515 Source advisory: GHSA-86VP-X3PR-79RX...

CVE-2020-17515

The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions prior to 1.10.13. This is same as CVE-2020-13944 but the implemented fix in Airflow 1.10.13 did not fix the issue completely...

CVE-2020-17515

The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions prior to 1.10.13. This is same as CVE-2020-13944 but the implemented fix in Airflow 1.10.13 did not fix the issue completely...

airflow-clickhouse-plugin (>=0.5.1, <=0.5.3), airflow-docker (>=0.1.1, <=1.1.0) +26 more potentially affected by CVE-2020-13944 +1 more via apache-airflow (>=1.8.2, <=1.10.12)

apache-airflow PYPI version =1.8.2, =0.5.1, =0.1.1, =2.4.2, =1.0.1, =1.2.1, =0.0.1.post1, =0.1.3a0, =0.4.0rc2, =1.7.2, =0.1.0, =0.0.1, =0.24.11, =0.24.11, =0.25.15 and more Source cves: CVE-2020-13944, CVE-2020-17515 Source advisory: OSV:PYSEC-2020-21...

CVE-2020-17515

The CVE-2020-17515 issue is an XSS vulnerability in the Apache Airflow “origin” parameter (e.g., in /trigger). The root cause is an unpatched origin parameter allowing reflected/scriptable input. Public details indicate affected versions include Airflow releases prior to the patched point (initia...

CVE-2020-17515

The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions prior to 1.10.13. This is same as CVE-2020-13944 but the implemented fix in Airflow 1.10.13 did not fix the issue completely...

aglow (>=0.1.0rc3, <=0.1.0rc4), ai-flow (0.3.1) +3 more potentially affected by CVE-2020-17515 via apache-airflow (>=2.0.0rc3, <=2.0.0)

apache-airflow PYPI version =2.0.0rc3, =0.1.0rc3, =0.1.0rc4 - ai-flow 0.3.1 - dataverk-airflow 0.3.12 - gps-building-blocks 1.2.2 - neuro-airflow-plugin 0.0.1 Source cves: CVE-2020-17515 Source advisory: MEND:CVE-2020-17515...

airflow-clickhouse-plugin (>=0.5.1, <=0.5.3), airflow-docker (>=0.1.1, <=1.1.0) +29 more potentially affected by CVE-2020-17515 via apache-airflow (>=1.8.2, <=1.10.14)

apache-airflow PYPI version =1.8.2, =0.5.1, =0.1.1, =2.4.2, =1.0.1, =1.2.1, =0.0.1.post1, =0.1.3a0, =0.4.0rc2, =1.7.2, =0.1.0, =0.0.1, =0.24.11, =0.25.15 and more Source cves: CVE-2020-17515 Source advisory: MEND:CVE-2020-17515...

CVE-2020-17515: Improper Neutralization of Input During Web Page Generation

The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions prior to 1.10.13. This is same as CVE-2020-13944 but the implemented fix in Airflow 1.10.13 did not fix the issue completely...