CVE-2021-28359 — Cross-site Scripting in Software Foundation Apache Airflow

CWE-79 — Cross-site Scripting5 documents4 sources
Severity
6.1MEDIUMNVD
EPSS
4.2%
top 11.30%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache Software Foundation Apache AirflowApache Airflow
Timeline
PublishedMay 2
Latest updateJun 18

Description

The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions <1.10.15 in 1.x series and affects 2.0.0 and 2.0.1 and 2.x series. This is the same as CVE-2020-13944 & CVE-2020-17515 but the implemented fix did not fix the issue completely. Update to Airflow 1.10.15 or 2.0.2. Please also update your Python version to the latest available PATCH releases of the installed MINOR versions, example update to Python 3.6.13…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

▶NVDapache/airflow1.0.0 — 1.10.15+1
▶CVEListV5apache_software_foundation/apache_airflowApache Airflow — 1.10.15+2

🔴Vulnerability Details

4
GHSA
Cross-site Scripting in Apache Airflow↗2021-06-18
▶
OSV
Cross-site Scripting in Apache Airflow↗2021-06-18
▶
OSV
CVE-2021-28359: The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit↗2021-05-02
▶
CVEList
Apache Airflow Reflected XSS via Origin Query Argument in URL↗2021-05-02
▶
CVE-2021-28359 — Cross-site Scripting | cvebase