CVE-2022-38054 Session Fixation

2022-09-0207:10:21

CWE-384

apache

www.cve.org

cve-2022-38054

apache airflow

session fixation

9.7 High

AI Score

Confidence

High

0.061 Low

EPSS

Percentile

93.6%

JSON

In Apache Airflow versions 2.2.4 through 2.3.3, the database webserver session backend was susceptible to session fixation.

CNA Affected

[
  {
    "product": "Apache Airflow",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "Apache Airflow*",
        "status": "affected",
        "version": "2.2.4",
        "versionType": "custom"
      }
    ]
  }
]