{"id":"CVE-2020-17515","published":"2020-12-11T13:40:12Z","modified":"2025-02-13T16:27:33Z","title":"The \"origin\" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit","vendor":"Apache","product":"Apache Airflow","tier":"tail","description":{"text":"The \"origin\" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions prior to 1.10.13. This is same as CVE-2020-13944 but the implemented fix in Airflow 1.10.13 did not fix the issue completely.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.16214,"percentile":0.96935,"provenance":"source"},"cwes":[],"references":[{"url":"https://lists.apache.org/thread.html/r4656959c8ed06c1f6202d89aa4e67b35ad7bdba5a666caff3fea888e%40%3Cusers.airflow.apache.org%3E","tags":["x_refsource_MISC"]},{"url":"https://lists.apache.org/thread.html/r2892ef594dbbf54d0939b808626f52f7c2d1584f8aa1d81570847d2a%40%3Cdev.airflow.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r2892ef594dbbf54d0939b808626f52f7c2d1584f8aa1d81570847d2a%40%3Cusers.airflow.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://www.openwall.com/lists/oss-security/2020/12/11/2","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r2892ef594dbbf54d0939b808626f52f7c2d1584f8aa1d81570847d2a%40%3Cannounce.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367%40%3Cusers.airflow.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://www.openwall.com/lists/oss-security/2021/05/01/2","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432%40%3Cannounce.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]}],"priority":{"score":19.4,"factors":[{"name":"EPSS percentile","points":19.39}]},"vendorSlug":"apache","affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache Airflow","versions":[">= Apache Airflow, < 1.10.13"]}],"affected":[{"ecosystem":"PyPI","package":"apache-airflow","vulnerableRanges":["<1.10.15rc1",">=2.0.0b1, <2.0.2rc1","<1.10.13"],"patched":["1.10.15rc1","2.0.2rc1","1.10.13"],"from":["GHSA-86vp-x3pr-79rx","PYSEC-2020-21"],"provenance":"source"}],"euvd":{"id":"EUVD-2020-0040","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2020-13944","published":"2020-09-17","fixed":"1.10.12","kev":false,"link":{"from":"CVE-2020-13944","to":"CVE-2020-17515","relation":"successor","confidence":"high","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:apache-airflow","fromFixed":"1.10.12","toFixed":"1.10.13","daysApart":85},{"kind":"same-code","provenance":"machine","files":["airflow/www/views.py"],"commits":["https://github.com/apache/airflow/commit/5c2bb7b0b0e717b11f093910b443243330ad93ca","https://github.com/apache/airflow/commit/13336272e32872247fa7d17e964ccd88ec8d1376","https://github.com/apache/airflow/commit/409c249121bd9c8902fc2ba551b21873ab41f953"],"basis":"shared file"},{"kind":"similar","provenance":"machine","score":0.73,"basis":"same package + description similarity"}]}},{"cve":"CVE-2025-67895","published":"2025-12-17","fixed":"2.0.0","kev":false},{"cve":"CVE-2021-26559","published":"2021-02-17","fixed":"2.0.1","kev":false},{"cve":"CVE-2021-26697","published":"2021-02-17","fixed":"2.0.1","kev":false},{"cve":"CVE-2020-17515","published":"2020-12-11","fixed":"2.0.2rc1","kev":false},{"cve":"CVE-2021-28359","published":"2021-05-02","fixed":"2.0.2","kev":false,"link":{"from":"CVE-2020-17515","to":"CVE-2021-28359","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:apache-airflow","fromFixed":"2.0.2rc1","toFixed":"2.0.2","daysApart":142},{"kind":"version-step","provenance":"source","package":"PyPI:apache-airflow","fromFixed":"1.10.15rc1","toFixed":"1.10.15","daysApart":142},{"kind":"similar","provenance":"machine","score":0.45,"basis":"same product + description similarity"}]}},{"cve":"CVE-2021-35936","published":"2021-08-16","fixed":"2.1.2","kev":false},{"cve":"CVE-2021-38540","published":"2021-09-09","fixed":"2.1.3","kev":false}],"package":"PyPI:apache-airflow"}}