What is GHSA-vcf6-3wv2-5vcr?

GHSA-vcf6-3wv2-5vcr is a security advisory published by GitHub Security Advisories with Medium severity. Apache Airflow vulnerable to stored Cross-site Scripting

Which CVE IDs does GHSA-vcf6-3wv2-5vcr cover?

GHSA-vcf6-3wv2-5vcr covers the following CVE IDs: CVE-2023-29247. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-vcf6-3wv2-5vcr?

GHSA-vcf6-3wv2-5vcr has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

Which products are affected by GHSA-vcf6-3wv2-5vcr?

GHSA-vcf6-3wv2-5vcr affects 1 product, including: pip/apache-airflow:\u003c 2.6.0.

GHSA-vcf6-3wv2-5vcrMediumCVSS 5.4

Apache Airflow vulnerable to stored Cross-site Scripting

Vendor

GitHub Security Advisories

Published

May 8, 2023

Last Modified

September 12, 2024

🔗 CVE IDs covered (1)

CVE-2023-29247 →

📋 Description

Task instance details page in the UI is vulnerable to stored cross-site scripting. This issue affects Apache Airflow before 2.6.0.

🎯 Affected products1

pip/apache-airflow:< 2.6.0

🔗 References (8)

https://nvd.nist.gov/vuln/detail/CVE-2023-29247
https://github.com/apache/airflow/pull/30447
https://github.com/apache/airflow/pull/30779
https://lists.apache.org/thread/kqf5lxmko133780clsp827xfsh4xd3fl
https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-60.yaml
https://github.com/apache/airflow/commit/46c85ec11d224c133da6c45c1186c9aa498a7e75
https://github.com/apache/airflow/commit/f819dfcb24c597058b7b671f6317e4c84976975e
https://github.com/advisories/GHSA-vcf6-3wv2-5vcr