Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Apache Airflow 2.2.4 Clear all filters
TI-2022-08169 CVE-2022-24288 · GHSA-3v7g-4pg3-7r6j

Apache Airflow: RCE in example DAGs

Priority HIGH 78

In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection from the web UI.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.78368 Published 2022-02-25 Fixed in 2.2.4 CWE-78
TI-2021-20450 CVE-2021-45229 · GHSA-65xw-pcqw-hjrh

Apache Airflow: Reflected XSS via Origin Query Argument in URL

Priority LOW 32

It was discovered that the "Trigger DAG with config" screen was susceptible to XSS attacks via the `origin` query argument.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.02601 Published 2022-02-25 Fixed in 2.2.4, 2.2.4rc1 CWE-79