CVE-2021-28359
CVSS V2 Medium 4.3
CVSS V3 Medium 6.1
Description
The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions <1.10.15 in 1.x series and affects 2.0.0 and 2.0.1 and 2.x series. This is the same as CVE-2020-13944 & CVE-2020-17515 but the implemented fix did not fix the issue completely. Update to Airflow 1.10.15 or 2.0.2. Please also update your Python version to the latest available PATCH releases of the installed MINOR versions, example update to Python 3.6.13 if you are on Python 3.6. (Those contain the fix for CVE-2021-23336 https://nvd.nist.gov/vuln/detail/CVE-2021-23336).
Overview
- CVE ID
- CVE-2021-28359
- Assigner
- security@apache.org
- Vulnerability Status
- Analyzed
- Published Version
- 2021-05-02T08:15:06
- Last Modified Date
- 2021-05-10T20:07:09
Weakness Enumerations
CPE Configuration (Product)
CPE | Vulnerable | Operator | Version Start | Version End |
---|---|---|---|---|
cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:* | 1 | OR | 1.0.0 | 1.10.15 |
cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:* | 1 | OR | 2.0.0 | 2.0.2 |
cpe:2.3:a:python:python:*:*:*:*:*:*:*:* | 1 | OR | 3.6.0 | 3.6.13 |
CVSS Version 2
- Version
- 2.0
- Vector String
- AV:N/AC:M/Au:N/C:N/I:P/A:N
- Access Vector
- NETWORK
- Access Compatibility
- MEDIUM
- Authentication
- NONE
- Confidentiality Impact
- NONE
- Integrity Impact
- PARTIAL
- Availability Impact
- NONE
- Base Score
- 4.3
- Severity
- MEDIUM
- Exploitability Score
- 8.6
- Impact Score
- 2.9
CVSS Version 3
- Version
- 3.1
- Vector String
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Attack Vector
- NETWORK
- Attack Compatibility
- LOW
- Privileges Required
- NONE
- User Interaction
- REQUIRED
- Scope
- CHANGED
- Confidentiality Impact
- LOW
- Availability Impact
- NONE
- Base Score
- 6.1
- Base Severity
- MEDIUM
- Exploitability Score
- 2.8
- Impact Score
- 2.7
References
Reference URL | Reference Tags |
---|---|
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367%40%3Cusers.airflow.apache.org%3E | Mailing List Vendor Advisory |
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E | Mailing List Vendor Advisory |
Sources
Source Name | Source URL |
---|---|
NIST | https://nvd.nist.gov/vuln/detail/CVE-2021-28359 |
MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28359 |
History
Created | Old Value | New Value | Data Type | Notes |
---|---|---|---|---|
2022-05-10 16:16:31 | Added to TrackCVE | |||
2022-12-05 01:25:08 | 2021-05-02T08:15Z | 2021-05-02T08:15:06 | CVE Published Date | updated |
2022-12-05 01:25:08 | 2021-05-10T20:07:09 | CVE Modified Date | updated | |
2022-12-05 01:25:08 | Analyzed | Vulnerability Status | updated |