UpHeron
All vulnerabilities

Servers and applications

CVE-2019-12417

A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. This also presented a Local File Disclosure vulnerability to any file readable by the webserver process.

Severity
Medium 4.8
Published
30 Oct 2019
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Exploit chance
1.3% in the next 30 daysHigher than 70% of CVEs. EPSS by FIRST, 10 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
Apache AirflowServers and applications · cpe:a:apache:airflow
  • Every version up to 1.10.5

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2019-12417
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2019-12417