What is GHSA-9gqg-3fxr-9hv7?

GHSA-9gqg-3fxr-9hv7 is a security advisory published by GitHub Security Advisories with Critical severity. Apache Airflow vulnerable to XSS

Which CVE IDs does GHSA-9gqg-3fxr-9hv7 cover?

GHSA-9gqg-3fxr-9hv7 covers the following CVE IDs: CVE-2017-17836. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-9gqg-3fxr-9hv7?

GHSA-9gqg-3fxr-9hv7 has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-9gqg-3fxr-9hv7?

GHSA-9gqg-3fxr-9hv7 affects 1 product, including: pip/apache-airflow:\u003c= 1.8.2.

GHSA-9gqg-3fxr-9hv7CriticalCVSS 9.8

Apache Airflow vulnerable to XSS

Vendor

GitHub Security Advisories

Published

January 25, 2019

Last Modified

September 12, 2024

🔗 CVE IDs covered (1)

CVE-2017-17836 →

📋 Description

In Apache Airflow 1.8.2 and earlier, an experimental Airflow feature displayed authenticated cookies, as well as passwords to databases used by Airflow. An attacker who has limited access to airflow, weather it be via XSS or by leaving a machine unlocked can exfil all credentials from the system.

🎯 Affected products1

pip/apache-airflow:<= 1.8.2

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2017-17836
https://github.com/advisories/GHSA-9gqg-3fxr-9hv7
https://lists.apache.org/thread.html/ade4d54ebf614f68dc81a08891755e60ea58ba88e0209233eeea5f57@%3Cdev.airflow.apache.org%3E
https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2019-149.yaml