CVE-2024-32077 Apache Airflow: XSS vulnerability in Task Instance Log/Log Details

2024-05-1410:43:20

CWE-79

apache

github.com

apache airflow

xss vulnerability

task instance log

log details

upgrade

AI Score

6.5

Confidence

High

EPSS

Percentile

15.5%

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

Apache Airflow version 2.9.0 has a vulnerability that allows an authenticated attacker to inject malicious data into the task instance logs.
Users are recommended to upgrade to version 2.9.1, which fixes this issue.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*"
    ],
    "vendor": "apache",
    "product": "airflow",
    "versions": [
      {
        "status": "affected",
        "version": "2.9.0"
      }
    ],
    "defaultStatus": "unknown"
  }
]