CVE-2022-40754: Open Redirect
Published Sep 21, 2022
·Updated
In Apache Airflow 2.3.0 through 2.3.4, there was an open redirect in the webserver's /confirm endpoint.
Affected Software
2 affected componentsFixes available
Apache Airflow>=2.3.0<=2.3.4
pip/apache-airflow>=2.3.0<2.4.0rc1
2.4.0rc1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/apache-airflowto a version that resolves this vulnerability.Fixed in 2.4.0rc1
Event History
Sep 21, 2022
CVE Published
via MITRE·07:25 AM
Data Sourced
via MITRE·07:25 AM
DescriptionWeakness
Data Sourced
via NVD·08:15 AM
RemedyDescriptionSeverityWeaknessAffected Software
Sep 22, 2022
Advisory Published
via GitHub·10:39 PM
Frequently Asked Questions
1
What is CVE-2022-40754?
CVE-2022-40754 is a vulnerability in Apache Airflow 2.3.0 through 2.3.4 that allows for an open redirect in the webserver's /confirm endpoint.
2
How severe is CVE-2022-40754?
CVE-2022-40754 has a severity rating of 6.1, which is considered medium.
3
How can I fix CVE-2022-40754?
To fix CVE-2022-40754, update Apache Airflow to version 2.4.0b1 or higher.
4
What is the CWE ID associated with CVE-2022-40754?
The CWE ID associated with CVE-2022-40754 is 601.
5
Where can I find more information about CVE-2022-40754?
You can find more information about CVE-2022-40754 on the NVD website and the GitHub references provided.