CVE-2022-43982

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

In Apache Airflow versions prior to 2.4.2, the "Trigger DAG with config" screen was susceptible to XSS attacks via the `origin` query argument.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Airflow	>= unspecified, < 2.4.2

References

https://github.com/apache/airflow/pull/27143Issue Tracking, Third Party Advisory
https://lists.apache.org/thread/vqnvdrfsw9z7v7c46qh3psjgr7wy959lIssue Tracking, Mailing List, Vendor Advisory
https://github.com/apache/airflow/pull/27143Issue Tracking, Third Party Advisory
https://lists.apache.org/thread/vqnvdrfsw9z7v7c46qh3psjgr7wy959lIssue Tracking, Mailing List, Vendor Advisory

Timeline

Published: Nov 2, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-439838.2Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application do CVE-2022-439848.2Browsershot version 3.57.3 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application do CVE-2022-439856.1In Apache Airflow versions prior to 2.4.2, there was an open redirect in the webserver's `/confirm` endpoint.CVE-2022-439897.3Password recovery vulnerability in SICK SIM2x00 (ARM) Partnumber 1092673 and 1081902 with firmware version < 1.2.0 allows an unprivileged re CVE-2022-43999.8A vulnerability was found in TicklishHoneyBee nodau. It has been rated as critical. Affected by this issue is some unknown functionality of CVE-2022-439907.3Password recovery vulnerability in SICK SIM1012 Partnumber 1098146 with firmware version <2.2.0 allows an unprivileged remote attacker to ga CVE-2022-439957.1Sudo 1.8.0 through 1.9.12, with the crypt() password backend, contains a plugins/sudoers/auth/passwd.c array-out-of-bounds error that can re CVE-2022-439965.4The csaf_provider package before 0.8.2 allows XSS via a crafted CSAF document uploaded as text/html. The endpoint upload allows valid CSAF a CVE-2022-439977.8Incorrect access control in Aternity agent in Riverbed Aternity before 12.1.4.27 allows for local privilege escalation. There is an insuffic CVE-2022-439999.8An issue was discovered in BACKCLICK Professional 5.9.63. Due to exposed CORBA management services, arbitrary system commands can be execute CVE-2022-44006.1A vulnerability was found in zbl1996 FS-Blog and classified as problematic. This issue affects some unknown processing of the component Titl CVE-2022-440009.8An issue was discovered in BACKCLICK Professional 5.9.63. Due to an exposed internal communications interface, it is possible to execute arb