{"id":"CVE-2020-13944","published":"2020-09-17T14:01:40Z","modified":"2024-08-04T12:32:14Z","title":"In Apache Airflow < 1.10.12, the \"origin\" parameter passed to some of the endpoints like '/trigger' was vulnerable to…","vendor":null,"product":null,"tier":"tail","description":{"text":"In Apache Airflow < 1.10.12, the \"origin\" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.25076,"percentile":0.97923,"provenance":"source"},"cwes":[],"references":[{"url":"https://lists.apache.org/thread.html/r97e1b60ca508a86be58c43f405c0c8ff00ba467ba0bee68704ae7e3e%40%3Cdev.airflow.apache.org%3E","tags":["x_refsource_MISC"]},{"url":"https://lists.apache.org/thread.html/r4656959c8ed06c1f6202d89aa4e67b35ad7bdba5a666caff3fea888e%40%3Cusers.airflow.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r2892ef594dbbf54d0939b808626f52f7c2d1584f8aa1d81570847d2a%40%3Cdev.airflow.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r2892ef594dbbf54d0939b808626f52f7c2d1584f8aa1d81570847d2a%40%3Cusers.airflow.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://www.openwall.com/lists/oss-security/2020/12/11/2","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r2892ef594dbbf54d0939b808626f52f7c2d1584f8aa1d81570847d2a%40%3Cannounce.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367%40%3Cusers.airflow.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://www.openwall.com/lists/oss-security/2021/05/01/2","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432%40%3Cannounce.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]}],"priority":{"score":19.6,"factors":[{"name":"EPSS percentile","points":19.58}]},"affectedVersions":[{"vendor":"n/a","product":"Apache Airflow","versions":["Apache Airflow < 1.10.12"]}],"affected":[{"ecosystem":"PyPI","package":"apache-airflow","vulnerableRanges":["<1.10.12"],"patched":["1.10.12"],"from":["GHSA-4pwq-fj89-6rjc","PYSEC-2020-19"],"provenance":"source"}],"euvd":{"id":"EUVD-2020-0038","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-apache-airflow-cve-2020-13944","children":[{"from":"CVE-2020-13944","to":"CVE-2023-39508","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["airflow/www/views.py"],"commits":["https://github.com/apache/airflow/commit/5c2bb7b0b0e717b11f093910b443243330ad93ca","https://github.com/apache/airflow/commit/101d59c4b88ab979d305b8d96f612c27c8a44aa8"],"basis":"shared function","functions":["xcom"]}]}],"packageHistory":[{"cve":"CVE-2020-11983","published":"2020-07-16","fixed":"1.10.11","kev":false},{"cve":"CVE-2020-13927","published":"2020-11-10","fixed":"1.10.11","kev":true},{"cve":"CVE-2020-9485","published":"2020-07-16","fixed":"1.10.11","kev":false},{"cve":"CVE-2020-13944","published":"2020-09-17","fixed":"1.10.12","kev":false},{"cve":"CVE-2020-17511","published":"2020-12-14","fixed":"1.10.13","kev":false,"link":{"from":"CVE-2020-13944","to":"CVE-2020-17511","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:apache-airflow","fromFixed":"1.10.12","toFixed":"1.10.13","daysApart":88}]}},{"cve":"CVE-2020-17513","published":"2020-12-14","fixed":"1.10.13","kev":false,"link":{"from":"CVE-2020-13944","to":"CVE-2020-17513","relation":"successor","confidence":"high","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:apache-airflow","fromFixed":"1.10.12","toFixed":"1.10.13","daysApart":88},{"kind":"same-code","provenance":"machine","files":["airflow/www/views.py"],"commits":["https://github.com/apache/airflow/commit/5c2bb7b0b0e717b11f093910b443243330ad93ca","https://github.com/apache/airflow/commit/b606b871226d649913a37fd074eeae5d86ebc3a1"],"basis":"shared file"}]}},{"cve":"CVE-2020-17526","published":"2020-12-21","fixed":"1.10.14","kev":false},{"cve":"CVE-2020-17515","published":"2020-12-11","fixed":"2.0.2rc1","kev":false,"link":{"from":"CVE-2020-13944","to":"CVE-2020-17515","relation":"successor","confidence":"high","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:apache-airflow","fromFixed":"1.10.12","toFixed":"1.10.13","daysApart":85},{"kind":"same-code","provenance":"machine","files":["airflow/www/views.py"],"commits":["https://github.com/apache/airflow/commit/5c2bb7b0b0e717b11f093910b443243330ad93ca","https://github.com/apache/airflow/commit/13336272e32872247fa7d17e964ccd88ec8d1376","https://github.com/apache/airflow/commit/409c249121bd9c8902fc2ba551b21873ab41f953"],"basis":"shared file"},{"kind":"similar","provenance":"machine","score":0.73,"basis":"same package + description similarity"}]}}],"package":"PyPI:apache-airflow"}}