CVE-2020-17515: apache software foundation apache airflow Cross-site Scripting

EPSS trend

Probability

16.21%

Chance of exploitation in the next 30 days

Percentile

97%

Versus all other CVEs

30-day change

0.00 pp

From 16.21% on 18-09-2026

18-09-202618-10-2026

EPSS score

16.21%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

References

27 links

lists.apache.org/thread.html/…X Refsource MISCWEBIssue TrackingMailing ListVendor Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
www.openwall.com/lists/oss-security/2020/12/11/2Mailing ListX Refsource MLISTWEBVendor Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
www.openwall.com/lists/oss-security/2021/05/01/2Mailing ListX Refsource MLISTWEBThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
nvd.nist.gov/vuln/detail/CVE-2020-17515Advisory
github.com/apache/airflow/pull/14738WEB

Show all 27 references

Related vulnerabilities

CVE-2018-20245apache software foundationapache airflow+21.02%7y ago23-01-2019 17:00The LDAP auth backend (airflow.contrib.auth.backends.ldap_auth) prior to Apache Airflow 1.10.1 was misconfigured and contained improper checking of exceptions which disabled server certificate checking.CVE-2018-20244apache software foundationapache airflow+21.96%7y ago27-02-2019 18:00In Apache Airflow before 1.10.2, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views.CVE-2021-29621apacheairflow+23.40%5y ago07-06-2021 19:00Flask-AppBuilder is a development framework, built on top of Flask. User enumeration in database authentication in Flask-AppBuilder <= 3.2.3. Allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in. Upgrade to version 3.3.0 or higher to resolve.CVE-2021-28359apache software foundationapache airflow+214.39%5y ago02-05-2021 07:55The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions <1.10.15 in 1.x series and affects 2.0.0 and 2.0.1 and 2.x series. This is the same as CVE-2020-13944 & CVE-2020-17515 but the implemented fix did not fix the issue completely. Update to Airflow 1.10.15 or 2.0.2. Please also update your Python version to the latest available PATCH releases of the installed MINOR versions, example update to Python 3.6.13 if you are on Python 3.6. (Those contain the fix for CVE-2021-23336 https://nvd.nist.gov/vuln/detail/CVE-2021-23336).CVE-2021-35936apache software foundationapache airflow+25.45%5y ago16-08-2021 07:25If remote logging is not used, the worker (in the case of CeleryExecutor) or the scheduler (in the case of LocalExecutor) runs a Flask logging server and is listening on a specific port and also binds on 0.0.0.0 by default. This logging server had no authentication and allows reading log files of DAG jobs. This issue affects Apache Airflow < 2.1.2.CVE-2025-54941apache software foundationapache airflow+20.49%11mo ago30-10-2025 09:45An example dag `example_dag_decorator` had non-validated parameter that allowed the UI user to redirect the example to a malicious server and execute code on worker. This however required that the example dags are enabled in production (not default) or the example dag code copied to build your own similar dag. If you used the `example_dag_decorator` please review it and apply the changes implemented in Airflow 3.0.5 accordingly.

All vulnerabilities inapache airflow airflow

CVE-2020-17515: apache software foundation apache airflow Cross-site Scripting

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References