Open Redirect

apacheairflow is vulnerable to open redirect attacks. The vulnerability exists in confirm function of views.py because of an open redirect in the webserver's confirm endpoint which allows an attacker to provide malicious URLs...

Cross-Site Scripting (XSS)

apacheairflow is vulnerable to cross-site scripting XSS. The vulnerability exists due to an incomplete fix of CVE-2020-17515, where the origin parameter passed to some endpoints were not sanitized...

Server-Side Request Forgery (SSRF)

apacheairflow is vulnerable to server-side request forgery SSRF. The vulnerability exists through the lack of sanitization of exception messages when SQL execution fails...

Cross-Site Scripting (XSS)

apacheairflow is vulnerable to Cross-Site Scripting XSS. An attacker is able to inject and execute arbitrary Javascript in a user's browser via the origin parameter that is passed to the /trigger endpoint...

Cross-Site Scripting (XSS)

apacheairflow is vulnerable to cross-site scripting XSS. An administrative user is able to inject and execute arbitrary Javascript into a user's browser by modifying the state of an object when the application is running with the classic UI...