Lucene search

GitHub Advisory DatabaseGHSA-M6JM-3V38-76J4

HistoryFeb 28, 2024 - 12:30 p.m.

Apache Superset: Improper Neutralization of custom SQL on embedded context

2024-02-2812:30:26

CWE-20

GitHub Advisory Database

github.com

apache superset

sql injection

security update

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

7.5

Confidence

High

EPSS

Percentile

9.0%

JSON

A guest user could exploit a chart data REST API and send arbitrary SQL statements that on error could leak information from the underlying analytics database.This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1.

Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue.

Affected configurations

Vulners

Node

apachesupersetRange3.1.0–3.1.1

apachesupersetRange≤3.0.3

VendorProductVersionCPE
apachesuperset*cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
apache	superset	*	cpe:2.3:a:apache:superset::::::::

References

www.openwall.com/lists/oss-security/2024/02/28/5

github.com/advisories/GHSA-m6jm-3v38-76j4

lists.apache.org/thread/gfl3ckwy6y9tpz9jmpv62orh2q346sn5

nvd.nist.gov/vuln/detail/CVE-2024-24772

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

7.5

Confidence

High

EPSS

Percentile

9.0%

JSON

Related for GHSA-M6JM-3V38-76J4