CVE-2024-25142

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-25142
Use of Web Browser Cache Containing Sensitive Information vulnerability in Apache Airflow.  Airflow did not return "Cache-Control" header for dynamic content, which in case of some browsers could result in potentially storing sensitive data in local cache of the browser. This issue affects Apache Airflow: before 2.9.2. Users are recommended to upgrade to version 2.9.2, which fixes the issue.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/apache/airflow/pull/39550 Patch
https://lists.apache.org/thread/cg1j28lk0fhzthk0of1g7vy7p2n1j7nr Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2024/06/13/1 Mailing List Third Party Advisory
https://github.com/apache/airflow/pull/39550 Patch
https://lists.apache.org/thread/cg1j28lk0fhzthk0of1g7vy7p2n1j7nr Mailing List Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*
History

11 Dec 2024, 15:37

Type Values Removed Values Added
References () https://github.com/apache/airflow/pull/39550 - () https://github.com/apache/airflow/pull/39550 - Patch
References () https://lists.apache.org/thread/cg1j28lk0fhzthk0of1g7vy7p2n1j7nr - () https://lists.apache.org/thread/cg1j28lk0fhzthk0of1g7vy7p2n1j7nr - Mailing List, Vendor Advisory
References () http://www.openwall.com/lists/oss-security/2024/06/13/1 - () http://www.openwall.com/lists/oss-security/2024/06/13/1 - Mailing List, Third Party Advisory
CPE cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
First Time Apache
Apache airflow
CWE NVD-CWE-Other

21 Nov 2024, 09:00

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/06/13/1 -
References () https://github.com/apache/airflow/pull/39550 - () https://github.com/apache/airflow/pull/39550 -
References () https://lists.apache.org/thread/cg1j28lk0fhzthk0of1g7vy7p2n1j7nr - () https://lists.apache.org/thread/cg1j28lk0fhzthk0of1g7vy7p2n1j7nr -

17 Jun 2024, 12:42

Type Values Removed Values Added
Summary
  • (es) Uso de la vulnerabilidad de caché del navegador web que contiene información confidencial en Apache Airflow. Airflow no devolvió el encabezado "Cache-Control" para contenido dinámico, lo que en el caso de algunos navegadores podría resultar en el almacenamiento de datos confidenciales en la caché local del navegador. Este problema afecta a Apache Airflow: antes de 2.9.2. Se recomienda a los usuarios actualizar a la versión 2.9.2, que soluciona el problema.

14 Jun 2024, 09:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-06-14 09:15

Updated : 2025-03-20 20:15

NVD link : CVE-2024-25142

Mitre link : CVE-2024-25142

CVE.ORG link : CVE-2024-25142

JSON object : View

Products Affected

apache

  • airflow
CWE
CWE-525

Use of Web Browser Cache Containing Sensitive Information

NVD-CWE-Other