CVE-2024-45033 (GCVE-0-2024-45033)
Vulnerability from cvelistv5
Published
2025-01-08 08:41
Modified
2025-01-08 13:59
Severity ?
CWE
  • CWE-613 - Insufficient Session Expiration
Summary
Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider. This issue affects Apache Airflow Fab Provider: before 1.5.2. When user password has been changed with admin CLI, the sessions for that user have not been cleared, leading to insufficient session expiration, thus logged users could continue to be logged in even after the password was changed. This only happened when the password was changed with CLI. The problem does not happen in case change was done with webserver thus this is different from  CVE-2023-40273 https://github.com/advisories/GHSA-pm87-24wq-r8w9  which was addressed in Apache-Airflow 2.7.0 Users are recommended to upgrade to version 1.5.2, which fixes the issue.
References
Impacted products
Vendor Product Version
Apache Software Foundation Apache Airflow Fab Provider Version: 0   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 8.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-45033",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-08T13:59:02.210778Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-08T13:59:37.707Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pypi.org/project/apache-airflow-providers-fab/",
          "defaultStatus": "unaffected",
          "packageName": "apache-airflow-providers-fab",
          "product": "Apache Airflow Fab Provider",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "1.5.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Saurabh Banawar"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eInsufficient Session Expiration vulnerability in Apache Airflow Fab Provider.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Airflow Fab Provider: before 1.5.2.\u003cbr\u003e\u003cbr\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eWhen user password has been changed with admin CLI, the sessions for that user have not been cleared, leading to insufficient session expiration, thus logged users could continue to be logged in even after the password was changed. This only happened when the password was changed with CLI. The problem does not happen in case change was done with webserver thus this is different from\u0026nbsp;\u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/advisories/GHSA-pm87-24wq-r8w9\"\u003eCVE-2023-40273\u003c/a\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;which was addressed in Apache-Airflow 2.7.0\u003c/span\u003e\u003cbr\u003e\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 1.5.2, which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider.\n\nThis issue affects Apache Airflow Fab Provider: before 1.5.2.\n\nWhen user password has been changed with admin CLI, the sessions for that user have not been cleared, leading to insufficient session expiration, thus logged users could continue to be logged in even after the password was changed. This only happened when the password was changed with CLI. The problem does not happen in case change was done with webserver thus this is different from\u00a0 CVE-2023-40273 https://github.com/advisories/GHSA-pm87-24wq-r8w9 \u00a0which was addressed in Apache-Airflow 2.7.0\n\n\nUsers are recommended to upgrade to version 1.5.2, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "low"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "CWE-613 Insufficient Session Expiration",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-08T08:41:39.579Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/apache/airflow/pull/45139"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/yw535346rk766ybzpqtvrl36sjj789st"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache Airflow Fab Provider: Application does not invalidate session after password change via Airflow cli",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2024-45033",
    "datePublished": "2025-01-08T08:41:39.579Z",
    "dateReserved": "2024-08-21T12:29:33.858Z",
    "dateUpdated": "2025-01-08T13:59:37.707Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-45033\",\"sourceIdentifier\":\"security@apache.org\",\"published\":\"2025-01-08T09:15:07.290\",\"lastModified\":\"2025-06-03T21:11:55.067\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider.\\n\\nThis issue affects Apache Airflow Fab Provider: before 1.5.2.\\n\\nWhen user password has been changed with admin CLI, the sessions for that user have not been cleared, leading to insufficient session expiration, thus logged users could continue to be logged in even after the password was changed. This only happened when the password was changed with CLI. The problem does not happen in case change was done with webserver thus this is different from\u00a0 CVE-2023-40273 https://github.com/advisories/GHSA-pm87-24wq-r8w9 \u00a0which was addressed in Apache-Airflow 2.7.0\\n\\n\\nUsers are recommended to upgrade to version 1.5.2, which fixes the issue.\"},{\"lang\":\"es\",\"value\":\"Vulnerabilidad de caducidad insuficiente de sesi\u00f3n en Apache Airflow Fab Provider. Este problema afecta a Apache Airflow Fab Provider: antes de 1.5.2. Cuando se ha cambiado la contrase\u00f1a de usuario con la CLI de administrador, las sesiones de ese usuario no se han borrado, lo que provoca una caducidad insuficiente de la sesi\u00f3n, por lo que los usuarios registrados pueden seguir conectados incluso despu\u00e9s de cambiar la contrase\u00f1a. Esto solo ocurre cuando se cambia la contrase\u00f1a con la CLI. El problema no ocurre en caso de que el cambio se haya realizado con el servidor web, por lo que es diferente de CVE-2023-40273 https://github.com/advisories/GHSA-pm87-24wq-r8w9 que se abord\u00f3 en Apache-Airflow 2.7.0 Se recomienda a los usuarios que actualicen a la versi\u00f3n 1.5.2, que soluciona el problema.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"security@apache.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-613\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:apache-airflow-providers-fab:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.5.2\",\"matchCriteriaId\":\"C8968CDB-A1E9-4FB8-BE4D-4A0281470411\"}]}]}],\"references\":[{\"url\":\"https://github.com/apache/airflow/pull/45139\",\"source\":\"security@apache.org\",\"tags\":[\"Issue Tracking\"]},{\"url\":\"https://lists.apache.org/thread/yw535346rk766ybzpqtvrl36sjj789st\",\"source\":\"security@apache.org\",\"tags\":[\"Mailing List\",\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"affected\": [{\"collectionURL\": \"https://pypi.org/project/apache-airflow-providers-fab/\", \"defaultStatus\": \"unaffected\", \"packageName\": \"apache-airflow-providers-fab\", \"product\": \"Apache Airflow Fab Provider\", \"vendor\": \"Apache Software Foundation\", \"versions\": [{\"lessThan\": \"1.5.2\", \"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\"}]}], \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Saurabh Banawar\"}], \"descriptions\": [{\"lang\": \"en\", \"supportingMedia\": [{\"base64\": false, \"type\": \"text/html\", \"value\": \"\u003cp\u003eInsufficient Session Expiration vulnerability in Apache Airflow Fab Provider.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Airflow Fab Provider: before 1.5.2.\u003cbr\u003e\u003cbr\u003e\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eWhen user password has been changed with admin CLI, the sessions for that user have not been cleared, leading to insufficient session expiration, thus logged users could continue to be logged in even after the password was changed. This only happened when the password was changed with CLI. The problem does not happen in case change was done with webserver thus this is different from\u0026nbsp;\u003c/span\u003e\u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://github.com/advisories/GHSA-pm87-24wq-r8w9\\\"\u003eCVE-2023-40273\u003c/a\u003e\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003e\u0026nbsp;which was addressed in Apache-Airflow 2.7.0\u003c/span\u003e\u003cbr\u003e\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 1.5.2, which fixes the issue.\u003c/p\u003e\"}], \"value\": \"Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider.\\n\\nThis issue affects Apache Airflow Fab Provider: before 1.5.2.\\n\\nWhen user password has been changed with admin CLI, the sessions for that user have not been cleared, leading to insufficient session expiration, thus logged users could continue to be logged in even after the password was changed. This only happened when the password was changed with CLI. The problem does not happen in case change was done with webserver thus this is different from\\u00a0 CVE-2023-40273 https://github.com/advisories/GHSA-pm87-24wq-r8w9 \\u00a0which was addressed in Apache-Airflow 2.7.0\\n\\n\\nUsers are recommended to upgrade to version 1.5.2, which fixes the issue.\"}], \"metrics\": [{\"other\": {\"content\": {\"text\": \"low\"}, \"type\": \"Textual description of severity\"}}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-613\", \"description\": \"CWE-613 Insufficient Session Expiration\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"orgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"shortName\": \"apache\", \"dateUpdated\": \"2025-01-08T08:41:39.579Z\"}, \"references\": [{\"tags\": [\"patch\"], \"url\": \"https://github.com/apache/airflow/pull/45139\"}, {\"tags\": [\"vendor-advisory\"], \"url\": \"https://lists.apache.org/thread/yw535346rk766ybzpqtvrl36sjj789st\"}], \"source\": {\"discovery\": \"UNKNOWN\"}, \"title\": \"Apache Airflow Fab Provider: Application does not invalidate session after password change via Airflow cli\", \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-45033\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-01-08T13:59:02.210778Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-01-08T13:59:31.512Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-45033\", \"assignerOrgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"apache\", \"dateReserved\": \"2024-08-21T12:29:33.858Z\", \"datePublished\": \"2025-01-08T08:41:39.579Z\", \"dateUpdated\": \"2025-01-08T13:59:37.707Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.