title: Apache Airflow prior to 2.4.2 allows reflected XSS via Origin Query Argument in URL
description: In Apache Airflow versions prior to 2.4.2, the "Trigger DAG with config" screen was susceptible to XSS attacks via the `origin` query argument.
problem types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
affected:
{
vendor: Apache Software Foundation
product: Apache Airflow
versions:
version: unspecified, lessThan: 2.4.2, status: affected, versionType: custom
}