Skip to main content

Insufficient Session Expiration

CVE-2024-45033

Low
2.1/10

Summary

Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider. This issue affects Apache Airflow Fab Provider versions prior to 1.5.2rc1 and 2.0.0rc1. When a user password has been changed with admin CLI, the sessions for that user have not been cleared, leading to insufficient session expiration; thus, logged-in users could continue to be logged in even after the password was changed. This only happened when the password was changed with CLI. The problem does not happen in case the change was done with the webserver; thus, this is different from CVE-2023-40273, which was addressed in Apache-Airflow 2.7.0. Users are recommended to upgrade to a version that fixes the issue.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • LOW
  • HIGH
  • NONE

CWE-613 - Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

References

Advisory Timeline

  • Published