CVE-2019-12417: Apache Airflow vulnerable to XSS and… – CVSS 4.8 · Watchpost

← All vulnerabilities

Apache Airflow vulnerable to XSS and local file disclosure

MEDIO 4.8CVE-2019-12417 · GHSA-q3p4-gw7r-wqjc · PYSEC-2019-216 · Published 30/10/2019 · updated 17/06/2026

En resumen

CVE-2019-12417 es una vulnerabilidad MEDIO (CVSS 4.8) que afecta a airflow, apache-airflow, airflow (apache).
Probabilidad de explotación en los próximos 30 días (EPSS): 1.3%, mayor que el 70.0% de las vulnerabilidades.
Solución: actualizar a 1.10.6, 1.10.6rc1 o posterior.

Package	Affected versions	Patched versions
airflow PyPI	`< 1.10.6`	`1.10.6`
apache-airflow PyPI	`< 1.10.6rc1`	`1.10.6rc1`
airflow apache	`≤ 1.10.5`	No fix yet

Description

A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. This also presented a Local File Disclosure vulnerability to any file readable by the webserver process.

NVD description

A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. This also presented a Local File Disclosure vulnerability to any file readable by the webserver process.

References

nvd.nist.gov/vuln/detail/CVE-2019-12417 · ADVISORY
apache/airflow commit caf1f26 · WEB
GitHub Advisory GHSA-q3p4-gw7r-wqjc · ADVISORY
apache/airflow · PACKAGE
pypa/advisory-database · WEB
lists.apache.org/thread.html/f3aa5ff9c7cdb5424b6463c9013f6cf5db83d26c66ea77130cbbe1bc@%3Cusers.airflow.apache.org%3E · WEB
lists.apache.org/thread.html/f3aa5ff9c7cdb5424b6463c9013f6cf5db83d26c66ea77130cbbe1bc%40%3Cusers.airflow.apache.org%3E
pypi.org/project/airflow · PACKAGE

Más vulnerabilidades de airflow

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free