CVE-2021-44451 API sensitive information leak

2022-02-0113:16:32

CWE-522

apache

www.cve.org

cve-2021-44451

api

sensitive information

apache superset

database connections

password leak

authenticated users

upgrade

AI Score

6.5

Confidence

High

EPSS

0.006

Percentile

78.6%

JSON

Apache Superset up to and including 1.3.2 allowed for registered database connections password leak for authenticated users. This information could be accessed in a non-trivial way. Users should upgrade to Apache Superset 1.4.0 or higher.

CNA Affected

[
  {
    "product": "Apache Superset",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "1.3.2",
        "status": "affected",
        "version": "Apache Superset",
        "versionType": "custom"
      }
    ]
  }
]