CVE-2021-45229

MEDIUM

Apache Airflow < 2.2.3 - Stored Cross-Site Scripting via Trigger DAG Origin Query Argument

Title source: llm
STIX 2.1

Description

It was discovered that the "Trigger DAG with config" screen was susceptible to XSS attacks via the `origin` query argument. This issue affects Apache Airflow versions 2.2.3 and below.

References (1)

Core 1
Core References
Mailing List, Vendor Advisory x_refsource_misc
https://lists.apache.org/thread/phx76cgtmhwwdy780rvwhobx8qoy4bnk

Scores

CVSS v3 6.1
EPSS 0.0156
EPSS Percentile 81.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (2)
apache/airflow < 2.2.3
pypi/apache-airflow 0 - 2.2.4rc1PyPI
Published Feb 25, 2022
Tracked Since Feb 18, 2026