CVE-2024-25142: 
Apache Airflow vulnerability analysis and mitigation

CVE-2024-25142 is a Use of Web Browser Cache Containing Sensitive Information vulnerability discovered in Apache Airflow. The vulnerability exists because Airflow did not return 'Cache-Control' header for dynamic content, which could potentially result in storing sensitive data in the local cache of some browsers. This vulnerability affects Apache Airflow versions before 2.9.2 (NVD, Apache Advisory).

The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The issue stems from the absence of Cache-Control headers in dynamically generated content, which could lead to sensitive information being stored in browser caches (NVD).

The vulnerability could result in sensitive data being stored in the local browser cache, potentially exposing confidential information to unauthorized users who have access to the same browser or system (Openwall).

The vulnerability requires local access and low privileges to exploit. No known exploits in the wild have been reported at the time of assessment (NVD).

Users are recommended to upgrade to Apache Airflow version 2.9.2, which fixes the issue by implementing proper Cache-Control headers for dynamically generated content. The fix involves adding a 'no-store' Cache-Control header to all dynamically generated content while preserving existing cache settings for static content (GitHub PR).