Riskcovery

CVE-2021-28359

Apache Airflow Reflected XSS via Origin Query Argument in URL

State
Published
Severity
Not scored
Published
May 2, 2021
Updated
Aug 3, 2024
Reserved
Mar 13, 2021

Read the record on cve.org

Description

The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions <1.10.15 in 1.x series and affects 2.0.0 and 2.0.1 and 2.x series. This is the same as CVE-2020-13944 & CVE-2020-17515 but the implemented fix did not fix the issue completely. Update to Airflow 1.10.15 or 2.0.2. Please also update your Python version to the latest available PATCH releases of the installed MINOR versions, example update to Python 3.6.13 if you are on Python 3.6. (Those contain the fix for CVE-2021-23336 https://nvd.nist.gov/vuln/detail/CVE-2021-23336).

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
Apache AirflowApache Software Foundation
  • Apache Airflow 2.0.0Affected
  • Apache Airflow 2.0.1Affected
  • Apache Airflow to before 1.10.15Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.