CVE-2023-29247: vulnerability in Apache Airflow
Stored XSS on Apache Airflow
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 2.0%
Task instance details page in the UI is vulnerable to a stored XSS.This issue affects Apache Airflow: before 2.6.0.
Affected products
Apache Software Foundation · Apache AirflowRelated CVEs — Apache Airflow
In the same product, most dangerous first.
CVE-2020-11978HIGHCVE-2020-11978EPSS 99.2%KEVCVE-2022-40127HIGHApache Airflow <2.4.0 has an RCE in a bash exampleEPSS 85.7%CVE-2022-45402MEDIUMApache Airflow: Open redirect during loginEPSS 81.8%CVE-2021-38540—Apache Airflow: Variable Import endpoint missed authentication checkEPSS 80.9%CVE-2022-24288—Apache Airflow: RCE in example DAGsEPSS 77.9%CVE-2020-11981—CVE-2020-11981EPSS 36.8%