id: PYSEC-2020-162
details: In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious
  admin user could edit the state of objects in the Airflow metadata database to execute
  arbitrary javascript on certain page views. The new "RBAC" UI is unaffected.
affected:
- package:
    name: apache-airflow
    ecosystem: PyPI
    purl: pkg:pypi/apache-airflow
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: '0'
    - fixed: 1.10.5
  versions:
  - 1.8.1
  - 1.8.2rc1
  - 1.8.2
  - 1.9.0
  - 1.10.0
  - 1.10.1b1
  - 1.10.1rc2
  - 1.10.1
  - 1.10.2b2
  - 1.10.2rc1
  - 1.10.2rc2
  - 1.10.2rc3
  - 1.10.2
  - 1.10.3b1
  - 1.10.3b2
  - 1.10.3rc1
  - 1.10.3rc2
  - 1.10.3
  - 1.10.4b2
  - 1.10.4rc1
  - 1.10.4rc2
  - 1.10.4rc3
  - 1.10.4rc4
  - 1.10.4rc5
  - 1.10.4
  - 1.10.5rc1
references:
- type: WEB
  url: http://www.openwall.com/lists/oss-security/2020/01/14/2
- type: WEB
  url: https://lists.apache.org/thread.html/r72487ad6b23d18689896962782f8c93032afe5c72a6bfd23b253352b%40%3Cusers.airflow.apache.org%3E
- type: WEB
  url: https://lists.apache.org/thread.html/r72487ad6b23d18689896962782f8c93032afe5c72a6bfd23b253352b@%3Cdev.airflow.apache.org%3E
- type: ADVISORY
  url: https://github.com/advisories/GHSA-rjvg-q57v-mjjc
aliases:
- CVE-2019-12398
- GHSA-rjvg-q57v-mjjc
modified: '2020-01-21T16:21:00Z'
published: '2020-01-14T17:15:00Z'