CVE-2022-38054
published 2022-09-02CVE-2022-38054: In Apache Airflow versions 2.2.4 through 2.3.3, the `database` webserver session backend was susceptible to session fixation.
PriorityP348critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.88%
77.0th percentile
In Apache Airflow versions 2.2.4 through 2.3.3, the `database` webserver session backend was susceptible to session fixation.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | airflow | 2.2.4 – 2.3.3 | — |
| apache_software_foundation | apache_airflow | >= 2.2.4 < Apache Airflow* | Apache Airflow* |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Apache Airflow Session Fixation vulnerability
ghsa·2022-09-03
CVE-2022-38054 [CRITICAL] CWE-384 Apache Airflow Session Fixation vulnerability
Apache Airflow Session Fixation vulnerability
In Apache Airflow versions 2.2.4 through 2.3.3, the `database` webserver session backend was susceptible to session fixation.
OSV
Apache Airflow Session Fixation vulnerability
osv·2022-09-03
CVE-2022-38054 [CRITICAL] Apache Airflow Session Fixation vulnerability
Apache Airflow Session Fixation vulnerability
In Apache Airflow versions 2.2.4 through 2.3.3, the `database` webserver session backend was susceptible to session fixation.
OSV
CVE-2022-38054: In Apache Airflow versions 2
osv·2022-09-02
CVE-2022-38054 CVE-2022-38054: In Apache Airflow versions 2
In Apache Airflow versions 2.2.4 through 2.3.3, the `database` webserver session backend was susceptible to session fixation.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-09-02
Published