CVE-2024-25142

Medium

Description

Use of Web Browser Cache Containing Sensitive Information vulnerability in Apache Airflow. Airflow did not return "Cache-Control" header for dynamic content, which in case of some browsers could result in potentially storing sensitive data in local cache of the browser. This issue affects Apache Airflow: before 2.9.2. Users are recommended to upgrade to version 2.9.2, which fixes the issue.

SeverityMedium

CVSS5.5

Exploit probability—

Product

Apache Airflow

PublishedJun 14, 2024

First seenJun 14, 2024

Weakness typeCWE-525CWE-525

How to fix

Update

apache airflow2.9.2 or later
apache-airflow2.9.2 or later

Patches

github.com/apache/airflow/pull/39550

Vendor advisories

lists.apache.org/thread/cg1j28lk0fhzthk0of1g7vy7p2n1j7nr

Affected products

Product	Affected versions	Fixed in
apache airflow	v < 2.9.2	2.9.2
apache-airflowPyPI	v < 2.9.2	2.9.2

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.