Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Python Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2021-28359 - Vulnerability Database
Python

Python Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2021-28359

Medium
Reference: CVE-2021-28359
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2021-28359
Title: Python Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability
Overview:

The quotoriginquot parameter passed to some of the endpoints like 39/trigger39 was vulnerable to XSS exploit. This issue affects Apache Airflow versions lt1.10.15 in 1.x series and affects 2.0.0 and 2.0.1 and 2.x series. This is the same as CVE-2020-13944 amp CVE-2020-17515 but the implemented fix did not fix the issue completely. Update to Airflow 1.10.15 or 2.0.2. Please also update your Python version to the latest available PATCH releases of the installed MINOR versions example update to Python 3.6.13 if you are on Python 3.6. (Those contain the fix for CVE-2021-23336 https://nvd.nist.gov/vuln/detail/CVE-2021-23336).