Apache Software Foundation · Apache Airflow
Apache Airflow's webserver contains an open redirect flaw in its /login endpoint, affecting versions prior to 2.4.3. An unauthenticated remote attacker can exploit it by getting a user to interact with a crafted link, such as clicking it, which sends the victim to an attacker-chosen external site after login.
In Apache Airflow versions prior to 2.4.3, there was an open redirect in the webserver's `/login` endpoint.
Disclosed on 15 Nov 2022. No public exploit code or confirmed exploitation is recorded.
7 fixes in apache-airflow over 10 months. The latest fix listed for apache-airflow is 2.5.2.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
1 package in 1 ecosystem. Main package: apache-airflow.
Upgrade to 2.4.3 or later
Fixes this CVE and 5 other known vulnerabilities in this package (CVE-2020-11978, CVE-2020-13927, +3).
pip install "apache-airflow>=2.4.3"The first fix for CVE-2022-45402.
| If you run | Upgrade to |
|---|---|
| All versions before 2.4.3 | 2.4.3 |
“Up to” means the second version is the fix and is not affected.