CVE-2017-12614

It was noticed an XSS in certain 404 pages that could be exploited to perform an XSS attack. Chrome will detect this as a reflected XSS attempt and prevent the page from loading. Firefox and other browsers don't, and are vulnerable to this attack. Mitigation: The fix for this is to upgrade to Apache Airflow 1.9.0 or above.

Score

CVSS 3.0 6.1 Medium

Status

Modified - security@apache.org

Published

2018-08-06

Last modified

2024-09-16

Weaknesses

CWE-79

Affected products

• Airflow (Apache)
• Apache Airflow (Apache Software Foundation)

References

• https://lists.apache.org/thread.html/2c72480c76619c5e7793f0d213c34082f0598eaa4d212172f068940f%40%3Cdev.airflow.apache.o…