CVE-2020-11983: 
Apache Airflow vulnerability analysis and mitigation

An issue was discovered in Apache Airflow versions 1.10.10 and below where many of the admin management screens in the new/RBAC UI handled escaping incorrectly, allowing authenticated users with appropriate permissions to create stored XSS attacks (NVD).

The vulnerability is classified as a Cross-site Scripting (XSS) issue, specifically CWE-79 (Improper Neutralization of Input During Web Page Generation). The CVSS v3.1 base score is 5.4 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The CVSS v2.0 base score is 3.5 (LOW) with the vector string (AV:N/AC:M/Au:S/C:N/I:P/A:N) (NVD).

The vulnerability allows authenticated users with appropriate permissions to create stored Cross-site Scripting (XSS) attacks in the admin management screens of the Apache Airflow RBAC UI. This could potentially lead to unauthorized access to sensitive information and manipulation of web content (NVD).

The vulnerability requires an authenticated user with appropriate permissions to exploit. The attack complexity is considered low, but user interaction is required for successful exploitation (NVD).

Users should upgrade to Apache Airflow versions higher than 1.10.10 which contains fixes for this vulnerability (NVD).