CVE-2019-12398

In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the state of objects in the Airflow metadata database to…

published January 14, 2020

CVSS
—
EPSS
3%
Percentile
86.5
In the wild
Unconfirmed
What it is

In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. The new "RBAC" UI is unaffected.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02824 · 86.5th percentile
Published
2020-01-14T16:28Z
EPSS history
Timeline
  • 14 JAN 16:28Z
    In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the state of objects in the Airflow metadata database to…
    cvelistv5