You are viewing a plain text version of this content. The canonical link for it is here.

Posted to announce@apache.org by Ephraim Anierobi <ep...@apache.org> on 2024/07/16 12:06:38 UTC

CVE-2024-39863: Apache Airflow: Potential XSS Vulnerability

Severity: low

Affected versions:

- Apache Airflow before 2.9.3

Description:

Apache Airflow versions before 2.9.3 have a vulnerability that allows an authenticated attacker to inject a malicious link when installing a provider. Users are recommended to upgrade to version 2.9.3, which fixes this issue.

Credit:

Seokchan Yoon (https://github.com/ch4n3-yoon) (finder)
Amogh Desai (remediation developer)

References:

https://github.com/apache/airflow/pull/40475
https://airflow.apache.org/
https://www.cve.org/CVERecord?id=CVE-2024-39863