CVE-2020-11983: XSS
Published Jul 16, 2020
·Updated
An issue was found in Apache Airflow versions 1.10.10 and below. It was discovered that many of the admin management screens in the new/RBAC UI handled escaping incorrectly, allowing authenticated users with appropriate permissions to create stored XSS attacks.
Affected Software
2 affected componentsFixes available
Apache Airflow<=1.10.10
pip/apache-airflow<1.10.11
1.10.11
Event History
Jul 16, 2020
CVE Published
via MITRE·11:21 PM
Data Sourced
via MITRE·11:21 PM
DescriptionWeakness
Jul 17, 2020
Data Sourced
via NVD·12:15 AM
DescriptionSeverityWeaknessAffected Software
Jul 27, 2020
Advisory Published
via GitHub·04:57 PM
Frequently Asked Questions
1
What is the severity of CVE-2020-11983?
CVE-2020-11983 is classified as a medium severity vulnerability due to its potential for stored XSS attacks.
2
How do I fix CVE-2020-11983?
To fix CVE-2020-11983, upgrade Apache Airflow to version 1.10.11 or later.
3
Who is affected by CVE-2020-11983?
CVE-2020-11983 affects Apache Airflow versions 1.10.10 and below.
4
What type of vulnerability is CVE-2020-11983?
CVE-2020-11983 is a stored cross-site scripting (XSS) vulnerability.
5
Can authenticated users exploit CVE-2020-11983?
Yes, authenticated users with appropriate permissions can exploit CVE-2020-11983 to create stored XSS attacks.