{"vulnerability": "CVE-2023-40273", "sightings": [{"uuid": "efec1299-a319-423b-9038-e7683eb09c3a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-40273", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/113791870409998283", "content": "", "creation_timestamp": "2025-01-08T08:49:08.152776Z"}, {"uuid": "17d67f67-ae1b-4d20-8864-fe67ec11687f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-40273", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/679", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-45033\n\ud83d\udd39 Description: Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider.\n\nThis issue affects Apache Airflow Fab Provider: before 1.5.2.\n\nWhen user password has been changed with admin CLI, the sessions for that user have not been cleared, leading to insufficient session expiration, thus logged users could continue to be logged in even after the password was changed. This only happened when the password was changed with CLI. The problem does not happen in case change was done with webserver thus this is different from\u00a0 CVE-2023-40273 https://github.com/advisories/GHSA-pm87-24wq-r8w9 \u00a0which was addressed in Apache-Airflow 2.7.0\n\n\nUsers are recommended to upgrade to version 1.5.2, which fixes the issue.\n\ud83d\udccf Published: 2025-01-08T08:41:39.579Z\n\ud83d\udccf Modified: 2025-01-08T08:41:39.579Z\n\ud83d\udd17 References:\n1. https://github.com/apache/airflow/pull/45139\n2. https://lists.apache.org/thread/yw535346rk766ybzpqtvrl36sjj789st", "creation_timestamp": "2025-01-08T09:12:24.000000Z"}, {"uuid": "7f02890b-3727-4a76-8ef3-71a704d4431b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-40273", "type": "seen", "source": "https://t.me/cvedetector/14673", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-45033 - Apache Airflow Fab Provider Insufficient Session Expiration Remote Authentication Bypass\", \n  \"Content\": \"CVE ID : CVE-2024-45033 \nPublished : Jan. 8, 2025, 9:15 a.m. | 30\u00a0minutes ago \nDescription : Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider.  \n  \nThis issue affects Apache Airflow Fab Provider: before 1.5.2.  \n  \nWhen user password has been changed with admin CLI, the sessions for that user have not been cleared, leading to insufficient session expiration, thus logged users could continue to be logged in even after the password was changed. This only happened when the password was changed with CLI. The problem does not happen in case change was done with webserver thus this is different from\u00a0 CVE-2023-40273  \u00a0which was addressed in Apache-Airflow 2.7.0  \n  \n  \nUsers are recommended to upgrade to version 1.5.2, which fixes the issue. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"08 Jan 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-01-08T10:47:49.000000Z"}, {"uuid": "155d3bc0-2275-4b95-8e42-ec9013714e02", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-40273", "type": "seen", "source": "https://t.me/ctinow/134615", "content": "https://ift.tt/fsdbUwx\nInternet Bug Bounty: CVE-2023-40273: Session fixation in Apache Airflow web interface", "creation_timestamp": "2023-09-04T16:03:01.000000Z"}, {"uuid": "5d8dccad-b26f-466b-8b73-c2ec8190010a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-40273", "type": "seen", "source": "https://t.me/cibsecurity/69072", "content": "\u203c CVE-2023-40273 \u203c\n\nThe session fixation vulnerability allowed the authenticated user to continue accessing Airflow webserver even after the password of the user has been reset by the admin - up until the expiry of the session of the user. Other than manually cleaning the session database (for database\u00c2\u00a0session backend), or changing the secure_key and restarting the webserver, there were no mechanisms to force-logout the user (and all other users with that).With this fix implemented, when using the\u00c2\u00a0database\u00c2\u00a0session backend, the existing sessions of the user are invalidated when the password of the user is reset. When using the securecookie\u00c2\u00a0session backend, the sessions are NOT invalidated and still require changing the secure key and restarting the webserver (and logging out all other users), but the user resetting the password is informed about it with a flash message warning displayed in the UI. Documentation is also updated explaining this behaviour.Users of Apache Airflow are advised to upgrade to version 2.7.0 or newer to mitigate the risk associated with this vulnerability.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-08-23T20:12:49.000000Z"}]}