The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions <1.10.15 in 1.x series and affects 2.0.0 and 2.0.1 and 2.x series. This is the same as CVE-2020-13944 & CVE-2020-17515 but the implemented fix did not fix the issue completely. Update to Airflow 1.10.15 or 2.0.2. Please also update your Python version to the latest available PATCH releases of the installed MINOR versions, example update to Python 3.6.13 if you are on Python 3.6. (Those contain the fix for CVE-2021-23336 https://nvd.nist.gov/vuln/detail/CVE-2021-23336).

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This
    issue affects Apache Airflow versions <1.10.15 in 1.x series and affects 2.0.0 and 2.0.1 and 2.x series.
    This is the same as CVE-2020-13944 & CVE-2020-17515 but the implemented fix did not fix the issue
    completely. Update to Airflow 1.10.15 or 2.0.2. Please also update your Python version to the latest
    available PATCH releases of the installed MINOR versions, example update to Python 3.6.13 if you are on
    Python 3.6. (Those contain the fix for CVE-2021-23336 https://nvd.nist.gov/vuln/detail/CVE-2021-23336).
    (CVE-2021-28359)

ID	Name	Product	Family	Type	Severity
452052	Google: dev-lang/python: security update to 17162.210.54	Tenable Cloud Security	Google COS Security Checks	Local	medium
452052	Google: dev-lang/python: security update to 17162.210.54	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	medium
409800	SCA: security update for apache-airflow (GHSA-3xxv-p78r-4fc6)	Tenable Cloud Security	SCA Checks	Local	medium
409800	SCA: security update for apache-airflow (GHSA-3xxv-p78r-4fc6)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2021-28359

medium

Tenable Plugins

medium

medium

medium

medium