CVE-2024-32077mediumCWE-79

CVE-2024-32077: medium-severity vulnerability in Apache Airflow

Apache Airflow: XSS vulnerability in Task Instance Log/Log Details

Published · Updated

Follow this CVE+ Monitor Apache Airflow+ Monitor apache-airflow

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.4epss 1.6%
Apache Airflow version 2.9.0 has a vulnerability that allows an authenticated attacker to inject malicious data into the task instance logs.  Users are recommended to upgrade to version 2.9.1, which fixes this issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected products
Apache Software Foundation · Apache Airflow
Related CVEs — Apache Airflow

In the same product, most dangerous first.

CVE-2020-11978HIGHCVE-2020-11978EPSS 99.2%KEVCVE-2022-40127HIGHApache Airflow <2.4.0 has an RCE in a bash exampleEPSS 85.7%CVE-2022-45402MEDIUMApache Airflow: Open redirect during loginEPSS 81.1%CVE-2021-38540—Apache Airflow: Variable Import endpoint missed authentication checkEPSS 80.9%CVE-2022-24288—Apache Airflow: RCE in example DAGsEPSS 78.4%CVE-2020-11981—CVE-2020-11981EPSS 36.8%