CVE-2017-12614
MEDIUMApache Airflow < 1.9.0 - Reflected Cross-Site Scripting in 404 Error Page
Title source: llmDescription
It was noticed an XSS in certain 404 pages that could be exploited to perform an XSS attack. Chrome will detect this as a reflected XSS attempt and prevent the page from loading. Firefox and other browsers don't, and are vulnerable to this attack. Mitigation: The fix for this is to upgrade to Apache Airflow 1.9.0 or above.
References (1)
Core 1
Core References
Mailing List mailing-list
x_refsource_mlist
https://lists.apache.org/thread.html/2c72480c76619c5e7793f0d213c34082f0598eaa4d212172f068940f%40%3Cdev.airflow.apache.org%3E
Scores
CVSS v3
6.1
EPSS
0.0226
EPSS Percentile
84.8%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Details
CWE
CWE-79
Status
published
Products (2)
apache/airflow
< 1.9.0
pypi/apache-airflow
0 - 1.9.0PyPI
Published
Aug 06, 2018
Tracked Since
Feb 18, 2026