CVE-2021-45229

MEDIUM6.1EPSS 1.6%

Apache Airflow: Reflected XSS via Origin Query Argument in URL

Published: 2/26/2022Modified: 5/20/2025

Also known as:GHSA-65xw-pcqw-hjrhBIT-airflow-2021-45229PYSEC-2022-29

Description

It was discovered that the "Trigger DAG with config" screen was susceptible to XSS attacks via the `origin` query argument. This issue affects Apache Airflow versions 2.2.3 and below.

Affected packages (3)

Bitnami/airflowfrom 0, < 2.2.4
PyPI/apache-airflowfrom 0, < 2.2.4rc1
PyPI/apache-airflowfrom 0, < 2.2.4rc1

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 4.0	—	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
osv	CVSS 3.1	MEDIUM6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References (6)

ADVISORYhttps://github.com/advisories/GHSA-65xw-pcqw-hjrh
ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2021-45229
PATCHhttps://github.com/apache/airflow
WEBhttps://github.com/apache/airflow/commit/628aa1f99c865d97d0b1c7c76e630e43a7b8d319
WEBhttps://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2022-29.yaml
WEBhttps://lists.apache.org/thread/phx76cgtmhwwdy780rvwhobx8qoy4bnk