CVE-2023-40273
published 2023-08-23CVE-2023-40273: The session fixation vulnerability allowed the authenticated user to continue accessing Airflow webserver even after the password of the user has been reset by…
PriorityP343high8CVSS 3.1
AVNACLPRLUIRSUCHIHAH
EPSS
1.37%
68.6th percentile
The session fixation vulnerability allowed the authenticated user to continue accessing Airflow webserver even after the password of the user has been reset by the admin - up until the expiry of the session of the user. Other than manually cleaning the session database (for database session backend), or changing the secure_key and restarting the webserver, there were no mechanisms to force-logout the user (and all other users with that).
With this fix implemented, when using the database session backend, the existing sessions of the user are invalidated when the password of the user is reset. When using the securecookie session backend, the sessions are NOT invalidated and still require changing the secure key and restarting the webserver (and logging out all other users), but the user resetting the password is informed about it with a flash message warning displayed in the UI. Documentation is also updated explaining this behaviour.
Users of Apache Airflow are advised to upgrade to version 2.7.0 or newer to mitigate the risk associated with this vulnerability.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | airflow | <= 2.7.0 | — |
| apache | apache-airflow-providers-fab | < 1.5.2 | 1.5.2 |
| apache | apache-airflow-providers-fab | >= 0 < 1.5.2 | 1.5.2 |
| apache_software_foundation | apache_airflow_fab_provider | < 1.5.2 | 1.5.2 |
CVSS provenance
nvdv3.18.0HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
ghsa8.0HIGH
osv8.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Apache Airflow Fab Provider Insufficient Session Expiration vulnerability
osv·2025-01-08·CVSS 8.0
CVE-2024-45033 [HIGH] Apache Airflow Fab Provider Insufficient Session Expiration vulnerability
Apache Airflow Fab Provider Insufficient Session Expiration vulnerability
Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider.
This issue affects Apache Airflow Fab Provider: before 1.5.2.
When user password has been changed with admin CLI, the sessions for that user have not been cleared, leading to insufficient session expiration, thus logged users could continue to be logged in even after the password was changed. This only happened when the password was changed with CLI. The problem does not happen in case change was done with webserver thus this is different from [CVE-2023-40273](https://github.com/advisories/GHSA-pm87-24wq-r8w9) which was addressed in Apache-Airflow 2.7.0
Users are recommended to upgrade to version 1.5.2, which fixes the issue.
GHSA
Apache Airflow Fab Provider Insufficient Session Expiration vulnerability
ghsa·2025-01-08·CVSS 8.0
CVE-2024-45033 [HIGH] CWE-613 Apache Airflow Fab Provider Insufficient Session Expiration vulnerability
Apache Airflow Fab Provider Insufficient Session Expiration vulnerability
Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider.
This issue affects Apache Airflow Fab Provider: before 1.5.2.
When user password has been changed with admin CLI, the sessions for that user have not been cleared, leading to insufficient session expiration, thus logged users could continue to be logged in even after the password was changed. This only happened when the password was changed with CLI. The problem does not happen in case change was done with webserver thus this is different from [CVE-2023-40273](https://github.com/advisories/GHSA-pm87-24wq-r8w9) which was addressed in Apache-Airflow 2.7.0
Users are recommended to upgrade to version 1.5.2, which fixes the issue.
OSV
Apache Airflow Session Fixation vulnerability
osv·2023-08-23
CVE-2023-40273 [HIGH] Apache Airflow Session Fixation vulnerability
Apache Airflow Session Fixation vulnerability
The session fixation vulnerability allowed the authenticated user to continue accessing Airflow webserver even after the password of the user has been reset by the admin - up until the expiry of the session of the user. Other than manually cleaning the session database (for database session backend), or changing the secure_key and restarting the webserver, there were no mechanisms to force-logout the user (and all other users with that).
With this fix implemented, when using the database session backend, the existing sessions of the user are invalidated when the password of the user is reset. When using the securecookie session backend, the sessions are NOT invalidated and still require changing the secure key and restarting the webserver (an
OSV
CVE-2023-40273: The session fixation vulnerability allowed the authenticated user to continue accessing Airflow webserver even after the password of the user has been
osv·2023-08-23
CVE-2023-40273 CVE-2023-40273: The session fixation vulnerability allowed the authenticated user to continue accessing Airflow webserver even after the password of the user has been
The session fixation vulnerability allowed the authenticated user to continue accessing Airflow webserver even after the password of the user has been reset by the admin - up until the expiry of the session of the user. Other than manually cleaning the session database (for database session backend), or changing the secure_key and restarting the webserver, there were no mechanisms to force-logout the user (and all other users with that).
With this fix implemented, when using the database session backend, the existing sessions of the user are invalidated when the password of the user is reset. When using the securecookie session backend, the sessions are NOT invalidated and still require changing the secure key and restarting the webserver (and logging out all other users), but the user re
GHSA
Apache Airflow Session Fixation vulnerability
ghsa·2023-08-23
CVE-2023-40273 [HIGH] CWE-384 Apache Airflow Session Fixation vulnerability
Apache Airflow Session Fixation vulnerability
The session fixation vulnerability allowed the authenticated user to continue accessing Airflow webserver even after the password of the user has been reset by the admin - up until the expiry of the session of the user. Other than manually cleaning the session database (for database session backend), or changing the secure_key and restarting the webserver, there were no mechanisms to force-logout the user (and all other users with that).
With this fix implemented, when using the database session backend, the existing sessions of the user are invalidated when the password of the user is reset. When using the securecookie session backend, the sessions are NOT invalidated and still require changing the secure key and restarting the webserver (an
No detection rules found.
No public exploits indexed.
HackerOne
Apache Airflow Fab Provider: Application does not invalidate session after password change via Airflow cli
hackerone·2025-05-29·CVSS 8.0
[HIGH] Apache Airflow Fab Provider: Application does not invalidate session after password change via Airflow cli
Apache Airflow Fab Provider: Application does not invalidate session after password change via Airflow cli
When a user changes his password by visiting `/resetmypassword` form, the application terminates all the existing sessions. This is to defend against the attack scenario when a user believes his account is hacked and so changes the password to ensure that he/she is the only one knowing the password in case the old password was compromised or session-id was compromised let us say using an XSS attack and then the application logs out all users making sure the attacker is also logged out and the legitimate user can safely log back in using the new password. However it has been observed that the application fails to terminate existing sessions if the password change was done by airflow c
HackerOne
CVE-2023-40273: Session fixation in Apache Airflow web interface
hackerone·2023-09-04·CVSS 8.0
CVE-2023-40273 [HIGH] CVE-2023-40273: Session fixation in Apache Airflow web interface
CVE-2023-40273: Session fixation in Apache Airflow web interface
When I reset the password of the test user through the button Reset Password, I hope that the person who previously had the password of the test user will lose the corresponding authority. However, if others have logged in to the test user before, they can still use the account.
{F2630619}
{F2630620}
In short，Change user password wouldn't prevent an already authenticated user from being able to continue using the UI or API.
## Impact
The session fixation vulnerability allowed the authenticated user to continue accessing Airflow webserver even after the password of the user has been reset by the admin - up until the expiry of the session of the user.
The session fixation vulnerability allowed the authenticated user to cont
https://github.com/apache/airflow/pull/33347https://lists.apache.org/thread/9rdmv8ln4y4ncbyrlmjrsj903x4l80njhttps://www.openwall.com/lists/oss-security/2023/08/23/1https://github.com/apache/airflow/pull/33347https://lists.apache.org/thread/9rdmv8ln4y4ncbyrlmjrsj903x4l80njhttps://www.openwall.com/lists/oss-security/2023/08/23/1
2023-08-23
Published