Summary
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Apache Superset ausnutzen, um seine Privilegien zu erhöhen, Informationen offenzulegen oder einen Cross Site Scripting Angriff durchzuführen.
Product
Apache Superset ist eine Open-Source-Plattform zur Datenexploration und -visualisierung.
Vulnerabilities 3
-
Medium 6.3
Apache Superset: Privilege escalation with default examples database
Improper authorization check and possible privilege escalation on Apache Superset up to but excluding 2.1.2. Using the default examples database connection that allows access to both the examples schema and Apache Superset's metadata database, an attacker usi…
-
Medium 4.3
Apache Superset: Unnecessary read permissions within the Gamma role
Unnecessary read permissions within the Gamma role would allow authenticated users to read configured CSS templates and annotations. This issue affects Apache Superset: before 2.1.2. Users should upgrade to version or above 2.1.2 and run `superset init` to re…
-
Medium 4.3
Apache Superset: Stored XSS on API endpoint
Improper payload validation and an improper REST API response type, made it possible for an authenticated malicious actor to store malicious code into Chart's metadata, this code could get executed if a user specifically accesses a specific deprecated API end…
Revision history
-
#1
Initiale Fassung
References
-
OSS Security Mailing List vom 2023-11-27
https://www.openwall.com/lists/oss-security/2023/11/27/4
-
OSS Security Mailing List vom 2023-11-27
https://www.openwall.com/lists/oss-security/2023/11/27/3
-
OSS Security Mailing List vom 2023-11-27
https://www.openwall.com/lists/oss-security/2023/11/27/2