{"id":"CVE-2022-41672","published":"2022-10-07T00:00:00Z","modified":"2024-08-03T12:49:43Z","title":"Session still functional after user is deactivated","vendor":"Apache","product":"Apache Airflow","tier":"tail","description":{"text":"In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01478,"percentile":0.73888,"provenance":"source"},"cwes":[{"id":"CWE-613","name":"DEPRECATED: Insufficient Session Expiration"}],"references":[{"url":"https://github.com/apache/airflow/pull/26635","tags":[]},{"url":"https://lists.apache.org/thread/ohf3pvd3dftb8zb01yngbn1jtkq5m08y","tags":[]}],"priority":{"score":14.8,"factors":[{"name":"EPSS percentile","points":14.78}]},"vendorSlug":"apache","affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache Airflow","versions":[">= unspecified, <= 2.4.0"]}],"affected":[{"ecosystem":"PyPI","package":"apache-airflow","vulnerableRanges":["<2.4.1rc1","<2.4.2rc1"],"patched":["2.4.1rc1","2.4.2rc1"],"from":["GHSA-3q8r-f3pj-3gc4","PYSEC-2022-42983"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-0018","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2022-40604","published":"2022-09-21","fixed":"2.4.0rc1","kev":false},{"cve":"CVE-2022-40754","published":"2022-09-21","fixed":"2.4.0rc1","kev":false},{"cve":"CVE-2022-40127","published":"2022-11-14","fixed":"2.4.0","kev":false},{"cve":"CVE-2022-41672","published":"2022-10-07","fixed":"2.4.2rc1","kev":false},{"cve":"CVE-2022-43982","published":"2022-11-02","fixed":"2.4.2","kev":false,"link":{"from":"CVE-2022-41672","to":"CVE-2022-43982","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:apache-airflow","fromFixed":"2.4.1rc1","toFixed":"2.4.2rc1","daysApart":26}]}},{"cve":"CVE-2022-43985","published":"2022-11-02","fixed":"2.4.2","kev":false,"link":{"from":"CVE-2022-41672","to":"CVE-2022-43985","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:apache-airflow","fromFixed":"2.4.1rc1","toFixed":"2.4.2rc1","daysApart":26}]}},{"cve":"CVE-2022-45402","published":"2022-11-15","fixed":"2.4.3","kev":false}],"package":"PyPI:apache-airflow"}}