Apache Airflow Cross-site Scripting Vulnerability

MOYENNE 6.1CVE-2021-45229 · BIT-airflow-2021-45229 · GHSA-65xw-pcqw-hjrh · Published 25/02/2022 · updated 17/06/2026

En bref

CVE-2021-45229 est une vulnérabilité MOYENNE (CVSS 6.1) touchant apache-airflow, airflow (apache).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 2.6%, plus élevée que 85.4% des vulnérabilités.
Correctif : mettre à jour vers 2.2.4rc1 ou plus récent.

Package	Affected versions	Patched versions
apache-airflow PyPI	`< 2.2.4rc1`	`2.2.4rc1`
airflow apache	`≤ 2.2.3`	No fix yet

Description

It was discovered that the "Trigger DAG with config" screen was susceptible to XSS attacks via the origin query argument. This issue affects Apache Airflow versions 2.2.3 and below.

NVD description

It was discovered that the "Trigger DAG with config" screen was susceptible to XSS attacks via the `origin` query argument. This issue affects Apache Airflow versions 2.2.3 and below.

References

nvd.nist.gov/vuln/detail/CVE-2021-45229 · ADVISORY
apache/airflow commit 628aa1f · WEB
GitHub Advisory GHSA-65xw-pcqw-hjrh · ADVISORY
apache/airflow · PACKAGE
pypa/advisory-database · WEB
lists.apache.org/thread/phx76cgtmhwwdy780rvwhobx8qoy4bnk · WEB

Autres vulnérabilités de apache-airflow

Tout voir →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

apache-airflow

PyPI

< 2.2.4rc1

2.2.4rc1

airflow

apache

≤ 2.2.3

No fix yet

Description

It was discovered that the "Trigger DAG with config" screen was susceptible to XSS attacks via the origin query argument. This issue affects Apache Airflow versions 2.2.3 and below.

NVD description

It was discovered that the "Trigger DAG with config" screen was susceptible to XSS attacks via the `origin` query argument. This issue affects Apache Airflow versions 2.2.3 and below.

Autres vulnérabilités de apache-airflow

Tout voir →