CVE-2022-43982

CVE-2022-43982: Apache Airflow prior to 2.4.2 allows reflected XSS via Origin Query Argument in URL

Vendor Apache Software Foundation

Product Apache Airflow

Weakness CWE-79 · XSS

Published November 2, 2022

Last update May 2, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

In Apache Airflow versions prior to 2.4.2, the "Trigger DAG with config" screen was susceptible to XSS attacks via the `origin` query argument.

Key dates

02Disclosure timeline

November 2, 2022 CVE published

May 2, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-43982 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html AskarLabs — CWE-79 write-up Cross-Site Scripting

Related vulnerabilities

04Related CVE

CVE-2026-2487 Admin Custom Login <= 3.6.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Message Above Login Form' Setting CVE-2026-28166 WordPress Tourmaster plugin <= 5.4.9 - Cross Site Scripting (XSS) vulnerability CVE-2026-64851 Grav Shortcode Core Plugin: Stored XSS in shortcode-core attribute handlers CVE-2026-78293 WordPress WP w3all phpBB plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability CVE-2026-66646 WordPress WP Tab Widget plugin <= 1.2.11 - Cross Site Scripting (XSS) vulnerability