Vulnerability · Published Dec 11, 2020 · Assigned by apache
CVE-2020-17515
Medium 6.1
In plain English
A medium-severity security flaw in Apache Airflow from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 16.2% (higher than 97% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)6.1Medium
Exploit odds (30 days)16.2%top 3.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions prior to 1.10.13. This is same as CVE-2020-13944 but the implemented fix in Airflow 1.10.13 did not fix the issue completely.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | apache-airflow | 1.10.15rc1 | GHSA-86vp-x3pr-79rx |
| PyPI | apache-airflow | 2.0.2rc1 | GHSA-86vp-x3pr-79rx |
| PyPI | apache-airflow | 1.10.13 | PYSEC-2020-21 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Airflow | Apache Airflow – before 1.10.13 |
References
- https://lists.apache.org/thread.html/r4656959c8ed06c1f6202d89aa4e67b35ad7bdba5a666caff3fea888e%40%3Cusers.airflow.apache.org%3E x_refsource_MISC
- [airflow-dev] 20201211 Apache Airflow Security Vulnerabilities fixed in v1.10.13: CVE-2020-17515 mailing-list, x_refsource_MLIST
- [airflow-users] 20201211 Apache Airflow Security Vulnerabilities fixed in v1.10.13: CVE-2020-17515 mailing-list, x_refsource_MLIST
- [oss-security] 20201211 CVE-2020-17515: Apache Airflow Reflected XSS via Origin Parameter mailing-list, x_refsource_MLIST
- [announce] 20201211 Apache Airflow Security Vulnerabilities fixed in v1.10.13: CVE-2020-17515 mailing-list, x_refsource_MLIST
- [airflow-users] 20210501 CVE-2021-28359: Apache Airflow Reflected XSS via Origin Query Argument in URL mailing-list, x_refsource_MLIST
- [oss-security] 20210501 CVE-2021-28359: Apache Airflow Reflected XSS via Origin Query Argument in URL mailing-list, x_refsource_MLIST
- [announce] 20210501 Apache Airflow CVE: CVE-2021-28359: Apache Airflow Reflected XSS via Origin Query Argument in URL mailing-list, x_refsource_MLIST