CVE-2019-12417

Advisory

A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. This also presented a Local File Disclosure vulnerability to any file readable by the webserver process.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://nvd.nist.gov/vuln/detail/CVE-2019-12417
• https://github.com/advisories/GHSA-q3p4-gw7r-wqjc
• https://lists.apache.org/thread.html/f3aa5ff9c7cdb5424b6463c9013f6cf5db83d26c66ea77130cbbe1bc@%3Cuse
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12417
• https://lists.apache.org/thread.html/f3aa5ff9c7cdb5424b6463c9013f6cf5db83d26c66ea77130cbbe1bc@%3Cusers.airflow.apache.org%3E