CVE-2024-25142: apache airflow

csirt@kutim:~/threat-intel/cve/CVE-2024-25142

CVSS 5.5 · Medium EPSS 0,32%

Kerentanan Use of Web Browser Cache Containing Sensitive Information pada apache airflow. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

Use of Web Browser Cache Containing Sensitive Information vulnerability in Apache Airflow. Airflow did not return "Cache-Control" header for dynamic content, which in case of some browsers could result in potentially storing sensitive data in local cache of the browser. This issue affects Apache Airflow: before 2.9.2. Users are recommended to upgrade to version 2.9.2, which fixes the issue.

Rincian

Terbit di NVD: 14 Juni 2024
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-525: Use of Web Browser Cache Containing Sensitive Information
EPSS (30 hari): 0,32% peluang dieksploitasi; lebih tinggi dari 23,2% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
apache	airflow	Semua versi sebelum 2.9.2

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://lists.apache.org/thread/cg1j28lk0fhzthk0of1g7vy7p2n1j7nr mailing list · advisory vendor
https://github.com/apache/airflow/pull/39550 patch
http://www.openwall.com/lists/oss-security/2024/06/13/1 mailing list · advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.