CVE-2020-17515: XSS
The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions prior to 1.10.13. This is same as CVE-2020-13944 but the implemented fix in Airflow 1.10.13 did not fix the issue completely.
Other sources
The origin parameter passed to some of the endpoints like /trigger was vulnerable to XSS exploit. This issue affects Apache Airflow versions prior to 1.10.15. This is same as CVE-2020-13944 but the implemented fix in Airflow 1.10.13 did not fix the issue completely.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-17515?
CVE-2020-17515 is a vulnerability in Apache Airflow versions prior to 1.10.13 where the 'origin' parameter passed to endpoints like '/trigger' is vulnerable to an XSS exploit.
How does CVE-2020-17515 affect Apache Airflow?
CVE-2020-17515 affects Apache Airflow versions prior to 1.10.13 by allowing an attacker to perform an XSS exploit through the 'origin' parameter passed to certain endpoints like '/trigger'.
What is the severity of CVE-2020-17515?
CVE-2020-17515 has a severity rating of 6.1 (medium).
How can I fix CVE-2020-17515?
To fix CVE-2020-17515, upgrade Apache Airflow to version 1.10.13 or later.
Where can I find more information about CVE-2020-17515?
You can find more information about CVE-2020-17515 at the following references: [Link 1](http://www.openwall.com/lists/oss-security/2020/12/11/2) [Link 2](http://www.openwall.com/lists/oss-security/2021/05/01/2) [Link 3](https://lists.apache.org/thread.html/r2892ef594dbbf54d0939b808626f52f7c2d1584f8aa1d81570847d2a@%3Cannounce.apache.org%3E)