Incorrect Authorization

2023-09-0805:57:11

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

apache superset

incorrect authorization

import_chart

user permissions

authenticated attacker

vulnerability

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS

0.001

Percentile

49.4%

JSON

Apache Superset is vulnerable to Incorrect Authorization. The vulnerability is caused by a missing user permissions check in the import_chart method inside superset/charts/commands/importers/v1/utils.py. A non admin authenticated attacker can create resources incorrectly while using the import charts feature to exploiting this vulnerability.