Lucene search

GitHub Advisory DatabaseGHSA-748R-5R8Q-273M

HistoryJul 07, 2022 - 12:00 a.m.

Apache Superset allows authenticated users to access metadata they have no permission to

2022-07-0700:00:26

CWE-273

GitHub Advisory Database

github.com

apache superset

unauthorized access

metadata

datasets

columns

metrics

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

29.4%

JSON

Apache Superset up to 1.5.1 allowed for authenticated users to access metadata information related to datasets they have no permission on. This metadata included the dataset name, columns and metrics.

Affected configurations

Vulners

Node

apachesupersetRange<1.5.1

VendorProductVersionCPE
apachesuperset*cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
apache	superset	*	cpe:2.3:a:apache:superset::::::::

References

github.com/advisories/GHSA-748r-5r8q-273m

github.com/apache/superset/commit/2bd89d1705347da5446902a3f65eb8d0a6353503

lists.apache.org/thread/pwqyxxmn5gh7cnw3qsp66v0lt4xojt82

nvd.nist.gov/vuln/detail/CVE-2021-37839

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

29.4%

JSON

Related for GHSA-748R-5R8Q-273M