CVE-2021-28359

Description

The origin parameter passed to some of the endpoints like /trigger was vulnerable to XSS exploit. This issue affects Apache Airflow versions <1.10.15 in 1.x series and affects 2.0.0 and 2.0.1 and 2.x series. This is the same as CVE-2020-13944 & CVE-2020-17515 but the implemented fix did not fix the issue completely. Update to Airflow 1.10.15 or 2.0.2. Please also update your Python version to the latest available PATCH releases of the installed MINOR versions, example update to Python 3.6.13 if you are on Python 3.6. (Those contain the fix for CVE-2021-23336 https://nvd.nist.gov/vuln/detail/CVE-2021-23336).

Risk Information

Base Score

6.1

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS Score

Exploitation Probability

4.16

Associated Vulnerability

Vulnerability	OS Platform
Vulnerability CVE-2021-28359 are affected in Python 3.6.12	Windows
Vulnerabilities CVE-2021-28359 are fixed in Python-apache-airflow 1.10.15	Windows
Vulnerabilities CVE-2021-28359 are fixed in Python-apache-airflow 2.0.2	Windows
Vulnerabilities CVE-2021-28359 are fixed in Python-apache-airflow for linux 1.10.15	Linux
Vulnerabilities CVE-2021-28359 are fixed in Python-apache-airflow for linux 2.0.2	Linux
Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability (CVE-2021-28359)	NCM

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234