{"id":"PYSEC-2022-280","details":"In Apache Airflow 2.3.0 through 2.3.4, there was an open redirect in the webserver's `/confirm` endpoint.","aliases":["BIT-airflow-2022-40754","CVE-2022-40754","GHSA-4fg5-j4mm-wfpg"],"modified":"2023-12-06T01:02:34.882178Z","published":"2022-09-21T08:15:00Z","references":[{"type":"WEB","url":"https://github.com/apache/airflow/pull/26409"},{"type":"WEB","url":"https://lists.apache.org/thread/cn098dcp5x3c402xrb06p3l7nz5goffm"}],"affected":[{"package":{"name":"apache-airflow","ecosystem":"PyPI","purl":"pkg:pypi/apache-airflow"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.4.0b1"}]}],"versions":["2.3.0","2.3.1","2.3.1rc1","2.3.2","2.3.2rc1","2.3.2rc2","2.3.3","2.3.3rc1","2.3.3rc2","2.3.3rc3","2.3.4","2.3.4rc1"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/apache-airflow/PYSEC-2022-280.yaml"}}],"schema_version":"1.7.3"}