Log in Start free

Vulnerability · Published Sep 17, 2020 · Assigned by apache

CVE-2020-13944

Medium 6.1

In plain English

A medium-severity security flaw in Apache Airflow. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 25.1% (higher than 98% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)6.1Medium
Exploit odds (30 days)25.1%top 2.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In Apache Airflow < 1.10.12, the "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIapache-airflow1.10.12GHSA-4pwq-fj89-6rjc
PyPIapache-airflow1.10.12PYSEC-2020-19

Affected products (as reported)

VendorProductVersions
n/a Apache Airflow Apache Airflow < 1.10.12

References