Apache Airflow, versions 2.6.0 through 2.7.3 has a stored XSS vulnerability that allows a DAG author to add an unbounded and not-sanitized javascript in the parameter description field of the DAG. This Javascript can be executed on the client side of any of the user who looks at the tasks in the browser sandbox. While this issue does not allow to exit the browser sandbox or manipulation of the server-side data - more than the DAG author already has, it allows to modify what the user looking at the DAG details sees in the browser - which opens up all kinds of possibilities of misleading other users. Users of Apache Airflow are recommended to upgrade to version 2.8.0 or newer to mitigate the risk associated with this vulnerability

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Apache Airflow, versions 2.6.0 through 2.7.3 has a stored XSS vulnerability that allows a DAG author to
    add an unbounded and not-sanitized javascript in the parameter description field of the DAG. This
    Javascript can be executed on the client side of any of the user who looks at the tasks in the browser
    sandbox. While this issue does not allow to exit the browser sandbox or manipulation of the server-side
    data - more than the DAG author already has, it allows to modify what the user looking at the DAG details
    sees in the browser - which opens up all kinds of possibilities of misleading other users. Users of Apache
    Airflow are recommended to upgrade to version 2.8.0 or newer to mitigate the risk associated with this
    vulnerability (CVE-2023-47265)

ID	Name	Product	Family	Type	Severity
463031	Echo: apache-airflow: security update to 2.8.0b1	Tenable Cloud Security	Echo Local Security Checks	Local	medium
463031	Echo: apache-airflow: security update to 2.8.0b1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
417769	SCA: security update for apache-airflow (GHSA-pxch-wr7m-rwxj)	Tenable Cloud Security	SCA Checks	Local	medium
417769	SCA: security update for apache-airflow (GHSA-pxch-wr7m-rwxj)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2023-47265

medium

Tenable Plugins

medium

medium

medium

medium