Lucene search

GoogleOSV:GHSA-748R-5R8Q-273M

HistoryJul 07, 2022 - 12:00 a.m.

Apache Superset allows authenticated users to access metadata they have no permission to

2022-07-0700:00:26

Google

osv.dev

apache superset

security

vulnerability

unauthorized access

dataset

metadata

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

29.4%

JSON

Apache Superset up to 1.5.1 allowed for authenticated users to access metadata information related to datasets they have no permission on. This metadata included the dataset name, columns and metrics.

References

github.com/apache/superset

github.com/apache/superset/commit/2bd89d1705347da5446902a3f65eb8d0a6353503

lists.apache.org/thread/pwqyxxmn5gh7cnw3qsp66v0lt4xojt82

nvd.nist.gov/vuln/detail/CVE-2021-37839

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

29.4%

JSON

Related for OSV:GHSA-748R-5R8Q-273M