CVE-2024-32077: Apache Airflow: XSS vulnerability in Task Instance Log/Log Details
Published May 14, 2024
·Updated
Apache Airflow version 2.9.0 has a vulnerability that allows an authenticated attacker to inject malicious data into the task instance logs. Users are recommended to upgrade to version 2.9.1, which fixes this issue.
Affected Software
7 affected componentsFixes available
pip/apache-airflow=2.9.0
2.9.1
Apache Airflow=2.9.0
Apache Airflow=2.9.0-beta1
Apache Airflow=2.9.0-beta2
Apache Airflow=2.9.0-rc1
Apache Airflow=2.9.0-rc2
Apache Airflow=2.9.0-rc3
Remediation
Patch Available
Event History
May 14, 2024
CVE Published
via MITRE·10:43 AM
Data Sourced
via MITRE·10:43 AM
DescriptionWeakness
Data Sourced
via NVD·04:17 PM
DescriptionWeakness
Data Sourced
via NVD·04:17 PM
RemedySeverityAffected Software
Advisory Published
via GitHub·06:31 PM
Frequently Asked Questions
1
What is the severity of CVE-2024-32077?
CVE-2024-32077 is classified as a moderate severity vulnerability.
2
How do I fix CVE-2024-32077?
To mitigate CVE-2024-32077, upgrade Apache Airflow to version 2.9.1.
3
What impact does CVE-2024-32077 have on Apache Airflow?
CVE-2024-32077 allows an authenticated attacker to inject malicious data into the task instance logs.
4
Which versions of Apache Airflow are affected by CVE-2024-32077?
CVE-2024-32077 affects Apache Airflow version 2.9.0 and its beta and release candidate versions.
5
Is it necessary to upgrade to a fixed version for CVE-2024-32077?
Yes, upgrading to version 2.9.1 is necessary to patch the vulnerability associated with CVE-2024-32077.