CVE-2024-45033

Apache Airflow Fab Provider: Application does not invalidate session after password change via Airflow cli

State: Published
Severity: 8.1 High
Published: Jan 8, 2025
Updated: Jan 8, 2025
Reserved: Aug 21, 2024

Description

Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider.

This issue affects Apache Airflow Fab Provider: before 1.5.2.

When user password has been changed with admin CLI, the sessions for that user have not been cleared, leading to insufficient session expiration, thus logged users could continue to be logged in even after the password was changed. This only happened when the password was changed with CLI. The problem does not happen in case change was done with webserver thus this is different from CVE-2023-40273 https://github.com/advisories/GHSA-pm87-24wq-r8w9 which was addressed in Apache-Airflow 2.7.0

Users are recommended to upgrade to version 1.5.2, which fixes the issue.

Scores

CVSS	Score	Vector	Source
3.1	8.1 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N	CISA-ADP

Weaknesses

CWE-613 Insufficient Session Expiration

Affected Products

Product	Versions
Apache Airflow Fab ProviderApache Software Foundation	before 1.5.2Affected

References

https://github.com/apache/airflow/pull/45139patch
https://lists.apache.org/thread/yw535346rk766ybzpqtvrl36sjj789stvendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.