CVE-2024-41937

Published: Aug 21, 2024Modified: Jun 17, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

Apache Airflow, versions before 2.10.0, have a vulnerability that allows the developer of a malicious provider to execute a cross-site scripting attack when clicking on a provider documentation link. This would require the provider to be installed on the web server and the user to click the provider link. Users should upgrade to 2.10.0 or later, which fixes this vulnerability.

Affected (1)

Products: Apache: Airflow

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Airflow	Before 2.10.0

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (3)

https://github.com/apache/airflow/pull/40933

Source: security@apache.org

Patch

https://lists.apache.org/thread/lwlmgg6hqfmkpvw5py4w53hxyl37jl6d

Source: security@apache.org

Third Party Advisory

http://www.openwall.com/lists/oss-security/2024/08/21/3

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.