PT-2023-22222 · Apache · Apache Airflow
CVSS v3.1
5.4
Medium
| Vector | AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Apache Airflow versions prior to 2.6.0
Description
The task instance details page in the UI is vulnerable to a stored cross-site scripting (XSS) issue. This allows for malicious scripts to be stored and executed on the page.
Recommendations
For versions prior to 2.6.0, update to version 2.6.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the task instance details page in the UI until a patch is applied.
Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Apache Airflow