CVE-2019-0216

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views.

Metrics

CVSS 3.0 4.8/10CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Apr 10, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-02177.5In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded server could allow a userCVE-2019-02186.1A vulnerability was discovered wherein a specially crafted URL could enable reflected XSS via JavaScript in the pony mail interface.CVE-2019-02199.8A website running in the InAppBrowser webview on Android could execute arbitrary JavaScript in the main application's webview using a speciaCVE-2019-02205.3A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38. When the path component of a request URL contains multiple consecutive slasCVE-2019-02216.1The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escapiCVE-2019-02227.5In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive.CVE-2019-02237.4While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27.0 (C library and itCVE-2019-02246.1In Apache JSPWiki 2.9.0 to 2.11.0.M2, a carefully crafted URL could execute javascript on another user's session. No information could be saCVE-2019-02257.5A specially crafted url could be used to access files under the ROOT directory of the application on Apache JSPWiki 2.9.0 to 2.11.0.M2, whicCVE-2019-02264.9Apache Karaf Config service provides a install method (via service or MBean) that could be used to travel in any directory and overwrite exiCVE-2019-02277.5A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and buCVE-2019-02289.8Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (X
CVE-2019-0216: Medium severity, CVSS 4.8 | Vulnix