What is GHSA-q3p4-gw7r-wqjc?

GHSA-q3p4-gw7r-wqjc is a security advisory published by GitHub Security Advisories with Medium severity. Apache Airflow vulnerable to XSS and local file disclosure

Which CVE IDs does GHSA-q3p4-gw7r-wqjc cover?

GHSA-q3p4-gw7r-wqjc covers the following CVE IDs: CVE-2019-12417. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-q3p4-gw7r-wqjc?

GHSA-q3p4-gw7r-wqjc has a CVSS v3 base score of 4.8, published by GitHub Security Advisories.

Which products are affected by GHSA-q3p4-gw7r-wqjc?

GHSA-q3p4-gw7r-wqjc affects 1 product, including: pip/airflow:\u003c 1.10.6.

GHSA-q3p4-gw7r-wqjcMediumCVSS 4.8

Apache Airflow vulnerable to XSS and local file disclosure

Vendor

GitHub Security Advisories

Published

November 22, 2019

Last Modified

September 11, 2024

🔗 CVE IDs covered (1)

CVE-2019-12417 →

📋 Description

A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. This also presented a Local File Disclosure vulnerability to any file readable by the webserver process.

🎯 Affected products1

pip/airflow:< 1.10.6

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2019-12417
https://lists.apache.org/thread.html/f3aa5ff9c7cdb5424b6463c9013f6cf5db83d26c66ea77130cbbe1bc@%3Cusers.airflow.apache.org%3E
https://github.com/apache/airflow/commit/caf1f264b845153b9a61b00b1a57acb7c320e743
https://github.com/advisories/GHSA-q3p4-gw7r-wqjc
https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2019-216.yaml