CVE-2022-41672
Session still functional after user is deactivated
Severity Score
8.1
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API.
En Apache Airflow, versiones anteriores a 2.4.1, desactivar un usuario no impedÃa que un usuario ya autenticado pudiera seguir usando la Interfaz de Usuario o la API
*Credits:
The Apache Airflow PMC would like to thank Axel Chong (@Haxatron) for reporting this issue.
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2022-09-27 CVE Reserved
- 2022-10-07 CVE Published
- 2024-08-03 CVE Updated
- 2024-10-03 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-613: Insufficient Session Expiration
CAPEC
References (2)
URL | Tag | Source |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://github.com/apache/airflow/pull/26635 | 2023-02-11 |
URL | Date | SRC |
---|---|---|
https://lists.apache.org/thread/ohf3pvd3dftb8zb01yngbn1jtkq5m08y | 2023-02-11 |