CVE-2022-41672

High

In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue…

apache·CWE-285·Published 2022-10-07

CVSS

8.1

EPSS

0.01

KEV

Exploits

cve.orgen

158 chars

In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API.

NVDen

158 chars

In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API.

GHSAen

158 chars

In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API.

NVDes

165 chars

En Apache Airflow, versiones anteriores a 2.4.1, desactivar un usuario no impedía que un usuario ya autenticado pudiera seguir usando la Interfaz de Usuario o la API

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
3.1	Primary	NVD	8.1	2.8	5.2	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
3.1	Secondary	GHSA	8.1	—	—	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
4.0	Secondary	GHSA	8.6	—	—	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N