CVE-2018-20244 Apache Airflow vulnerable to Stored XSS
A malicious admin can inject JavaScript into Airflow pages via database edits, enabling code execution or account takeover.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-20244?
CVE-2018-20244 is a medium-severity cross-site scripting vulnerability in Apache Airflow, published on 27 Feb 2019. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
In Apache Airflow before 1.10.2, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views.
Weakness: CWE-79
Which versions are affected by CVE-2018-20244?
3 open source packages ship an affected version, including apache-airflow. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
apache-airflow PyPI | All versions | 1.10.2 |
apache-airflow PyPI | All versions | 1.10.2 |
apache-airflow PyPI | All versions | 1.10.2 |
Products include Apache Airflow.
How do I fix CVE-2018-20244?
Upgrade apache-airflow to 1.10.2 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2018-20244 being exploited?
There is no known exploitation of CVE-2018-20244 in the wild and no public exploit code.
Other vulnerabilities in Apache Airflow
- CVE-2020-13927 Apache Airflow's Experimental API Authentication Bypass
- CVE-2020-11978 Apache Airflow Command Injection
- CVE-2026-33264 Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize()
- CVE-2023-25754 Apache Airflow: Privilege escalation using airflow logs
- CVE-2023-22884 Apache Airflow, Apache Airflow MySQL Provider: Arbitrary file read via MySQL provider in Apache Airflow
Sources
Also known as GHSA-99cv-8cvv-666c, PYSEC-2019-142.