CVE-2024-32077CWE-79

Apache Airflow: XSS vulnerability in Task Instance Log/Log Details

Medium · published May 14, 2024

CVSS v3.1
5.4
EPSS
2%
Percentile
75.2
In the wild
Unconfirmed
What it is

Apache Airflow version 2.9.0 has a vulnerability that allows an authenticated attacker to inject malicious data into the task instance logs.

Users are recommended to upgrade to version 2.9.1, which fixes this issue.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01572 · 75.2th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-05-14T10:43Z
EPSS history
Timeline
  • 14 MAY 10:43Z
    Apache Airflow: XSS vulnerability in Task Instance Log/Log Details
    cvelistv5