8.1

CVE-2022-41672

Session still functional after user is deactivated

In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Apache ≫ Airflow Version <= 2.4.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.2% 0.641
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.1 2.8 5.2
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CWE-613 Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

https://github.com/apache/airflow/pull/26635
Patch
Third Party Advisory
Issue Tracking
https://lists.apache.org/thread/ohf3pvd3dftb8zb01yngbn1jtkq5m08y
Vendor Advisory
Mailing List
Issue Tracking