Attributed metadata history
Up to 100 retained publisher events per page for 6f3eef382954404e0b598e22393e0973b103f08bb439d7ca2017ad808a279570. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_d11443da85ea659d49
observed · 2026-10-12 15:37:03 UTC
available
Fingerprint: 46fd50ac705e064c7517d97d61b5ec511c9b1ada6209622159dd39573ba08e5c
intelligence_src_d11443da85ea659d49
observed · 2026-10-12 15:37:03 UTC
Amazon Managed Workflows for Apache Airflow (MWAA) and the Task instance details page in the Google Composer UI were not patched against CVE-2023-29247 (Stored XSS). This meant that post-authentication, a threat actor could have exploited this to store their JavaScript payload in the victim's managed Apache Airflow instance and run JavaScript on behalf of the victim (who could be an admin or another user with higher permissions than the threat actor, thereby leading to privilege escalation). With JavaScript, threat actors could have run any operation in the session that the victim is able to run — edit tasks, read jobs, run jobs, read plugins and configurations, list connections, add variables and more.
Fingerprint: 74a0d97eb2f0d1fd136703293e1840a3fd71c0175c7c3896dff989a52776985c