CVE-2024-24779

2024-02-2812:15:47

CWE-863

apache

web.nvd.nist.gov

apache superset

cve-2024-24779

data access

unauthorized access

virtual datasets

security vulnerability

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

AI Score

5.1

Confidence

High

EPSS

Percentile

9.0%

JSON

Apache Superset with custom roles that include can write on dataset and without all data access permissions, allows for users to create virtual datasets to data they don’t have access to. These users could then use those virtual datasets to get access to unauthorized data.
This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1.

Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue.

Affected configurations

Vulners

Node

apachesupersetRange≤3.0.4

apachesupersetRange≤3.1.1

VendorProductVersionCPE
apachesuperset*cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
apache	superset	*	cpe:2.3:a:apache:superset::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache Superset",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "3.0.4",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      },
      {
        "lessThan": "3.1.1",
        "status": "affected",
        "version": "3.1.0",
        "versionType": "semver"
      }
    ]
  }
]