CVE-2024-41937CWE-79

Apache Airflow: Stored XSS Vulnerability on provider link

Medium · published August 21, 2024

CVSS v3.1
6.1
EPSS
2%
Percentile
77.4
In the wild
Unconfirmed
What it is

Apache Airflow, versions before 2.10.0, have a vulnerability that allows the developer of a malicious provider to execute a cross-site scripting attack when clicking on a provider documentation link. This would require the provider to be installed on the web server and the user to click the provider link.

Users should upgrade to 2.10.0 or later, which fixes this vulnerability.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01730 · 77.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-08-21T15:31Z
EPSS history
Timeline
  • 21 AUG 15:31Z
    Apache Airflow: Stored XSS Vulnerability on provider link
    cvelistv5