Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-e19b-adrm-x7fu
Vulnerability ID VCID-e19b-adrm-x7fu
Aliases BIT-airflow-2022-45402
CVE-2022-45402
GHSA-rg94-84xj-7gq3
PYSEC-2022-42984
Summary In Apache Airflow versions prior to 2.4.3, there was an open redirect in the webserver's `/login` endpoint.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
System Score Found at
epss 0.04787 https://api.first.org/data/v1/epss?cve=CVE-2022-45402
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-rg94-84xj-7gq3
cvssv3.1 6.1 https://github.com/apache/airflow
generic_textual MODERATE https://github.com/apache/airflow
cvssv3.1 6.1 https://github.com/apache/airflow/commit/f0f67e8bc9dcb9444cfc5b88ee075191785469b7
generic_textual MODERATE https://github.com/apache/airflow/commit/f0f67e8bc9dcb9444cfc5b88ee075191785469b7
cvssv3.1 6.1 https://github.com/apache/airflow/pull/27576
generic_textual MODERATE https://github.com/apache/airflow/pull/27576
ssvc Track https://github.com/apache/airflow/pull/27576
cvssv3.1 6.1 https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2022-42984.yaml
generic_textual MODERATE https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2022-42984.yaml
cvssv3.1 6.1 https://lists.apache.org/thread/nf4xrkoo6c81g6fdn4vj8k9x2686o9nh
generic_textual MODERATE https://lists.apache.org/thread/nf4xrkoo6c81g6fdn4vj8k9x2686o9nh
ssvc Track https://lists.apache.org/thread/nf4xrkoo6c81g6fdn4vj8k9x2686o9nh
cvssv3.1 6.1 https://nvd.nist.gov/vuln/detail/CVE-2022-45402
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2022-45402
cvssv3.1 6.1 http://www.openwall.com/lists/oss-security/2022/11/15/1
generic_textual MODERATE http://www.openwall.com/lists/oss-security/2022/11/15/1
ssvc Track http://www.openwall.com/lists/oss-security/2022/11/15/1
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2022-45402
https://github.com/apache/airflow
https://github.com/apache/airflow/commit/f0f67e8bc9dcb9444cfc5b88ee075191785469b7
https://github.com/apache/airflow/pull/27576
https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2022-42984.yaml
https://lists.apache.org/thread/nf4xrkoo6c81g6fdn4vj8k9x2686o9nh
http://www.openwall.com/lists/oss-security/2022/11/15/1
CVE-2022-45402 https://nvd.nist.gov/vuln/detail/CVE-2022-45402
GHSA-rg94-84xj-7gq3 https://github.com/advisories/GHSA-rg94-84xj-7gq3
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/apache/airflow
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/apache/airflow/commit/f0f67e8bc9dcb9444cfc5b88ee075191785469b7
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/apache/airflow/pull/27576
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T15:54:53Z/ Found at https://github.com/apache/airflow/pull/27576
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2022-42984.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://lists.apache.org/thread/nf4xrkoo6c81g6fdn4vj8k9x2686o9nh
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T15:54:53Z/ Found at https://lists.apache.org/thread/nf4xrkoo6c81g6fdn4vj8k9x2686o9nh
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2022-45402
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at http://www.openwall.com/lists/oss-security/2022/11/15/1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T15:54:53Z/ Found at http://www.openwall.com/lists/oss-security/2022/11/15/1
Exploit Prediction Scoring System (EPSS)
Percentile 0.89642
EPSS Score 0.04787
Published At May 30, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-30T20:31:01.953438+00:00 Pypa Importer Import https://github.com/pypa/advisory-database/blob/main/vulns/apache-airflow/PYSEC-2022-42984.yaml 38.6.0