You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@airflow.apache.org by Ash Berlin-Taylor <as...@apache.org> on 2019/10/30 09:06:24 UTC
[CVE-2019-12417] Apache Airflow stored xss and local file disclosure
vulnerability <= 1.10.5
CVE-2019-12417: Stored XSS and Local File Disclosure vulnerability
Versions Affected:
<= 1.10.5
Description:
A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. This also presented a Local File Disclosure vulnerability to any file readable by the webserver process.
Credit:
Thanks to Pawel.Kurylowicz (of securing.pl), and Frantisek Uhrecky and Marek Takac (both of citadelo.com) for all independently reporting this vulnerability.
Thanks,
Ash
Apache Airflow PMC member