CVE-2022-43985

In Apache Airflow versions prior to 2.4.2, there was an open redirect in the webserver's `/confirm` endpoint.

• CWE-601

• https://github.com/apache/airflow/pull/27143Issue Tracking, Patch, Third Party Advisory
• https://lists.apache.org/thread/m13y9s5kw92fw9l8j4qd85h0txp4kfcqIssue Tracking, Mailing List, Vendor Advisory
• https://github.com/apache/airflow/pull/27143Issue Tracking, Patch, Third Party Advisory
• https://lists.apache.org/thread/m13y9s5kw92fw9l8j4qd85h0txp4kfcqIssue Tracking, Mailing List, Vendor Advisory

Published

Nov 2, 2022

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-43979There is a Path Traversal that leads to a Local File Inclusi…9.8
• CVE-2022-4398Integer Overflow or Wraparound in GitHub repository radareor…7.8
• CVE-2022-43980There is a stored cross-site scripting vulnerability in Pand…5.4
• CVE-2022-43982In Apache Airflow versions prior to 2.4.2, the "Trigger DAG …6.1
• CVE-2022-43983Browsershot version 3.57.2 allows an external attacker to re…8.2
• CVE-2022-43984Browsershot version 3.57.3 allows an external attacker to re…8.2
• CVE-2022-43989Password recovery vulnerability in SICK SIM2x00 (ARM) Partnu…7.3
• CVE-2022-4399A vulnerability was found in TicklishHoneyBee nodau. It has …9.8
• CVE-2022-43990Password recovery vulnerability in SICK SIM1012 Partnumber 1…7.3
• CVE-2022-43995Sudo 1.8.0 through 1.9.12, with the crypt() password backend…7.1
• CVE-2022-43996The csaf_provider package before 0.8.2 allows XSS via a craf…5.4
• CVE-2022-43997Incorrect access control in Aternity agent in Riverbed Atern…7.8