CVE-2022-38054 — Session Fixation in Software Foundation Apache Airflow

CWE-384 — Session Fixation5 documents4 sources
Severity
9.8CRITICALNVD
EPSS
2.2%
top 15.60%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache Software Foundation Apache AirflowApache Airflow
Timeline
PublishedSep 2
Latest updateSep 3

Description

In Apache Airflow versions 2.2.4 through 2.3.3, the `database` webserver session backend was susceptible to session fixation.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5apache_software_foundation/apache_airflow2.2.4 — Apache Airflow*
▶NVDapache/airflow2.2.4 — 2.3.3

🔴Vulnerability Details

4
GHSA
Apache Airflow Session Fixation vulnerability↗2022-09-03
▶
OSV
Apache Airflow Session Fixation vulnerability↗2022-09-03
▶
OSV
CVE-2022-38054: In Apache Airflow versions 2↗2022-09-02
▶
CVEList
Session Fixation↗2022-09-02
▶
CVE-2022-38054 — Session Fixation | cvebase