Skip to content
OpenAdvisories
Medium WID-SEC-2023-3023 3 CVEs

Apache Superset: Mehrere Schwachstellen

Published Nov 28, 2023 · Updated Nov 28, 2023 · de-DE

Vendor: Apache Product: Superset < 3.0.0 Platform: Linux Platform: macOS Platform: Windows

Summary

Ein entfernter, authentifizierter Angreifer kann mehrere Schwachstellen in Apache Superset ausnutzen, um Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand zu verursachen oder vertrauliche Informationen offenzulegen.

Product

Apache Superset ist eine Open-Source-Plattform zur Datenexploration und -visualisierung.

Vulnerabilities 3

  • Medium 5.8
    CVE-2023-42504

    Apache Superset: Lack of rate limiting allows for possible denial of service

    An authenticated malicious user could initiate multiple concurrent requests, each requesting multiple dashboard exports, leading to a possible denial of service. This issue affects Apache Superset: before 3.0.0

    Apache Software Foundation Apache Superset apache-superset PyPI
  • Medium 4.8
    CVE-2023-42502

    Apache Superset: Open Redirect Vulnerability

    An authenticated attacker with update datasets permission could change a dataset link to an untrusted site by spoofing the HTTP Host header, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset vers…

    Apache Software Foundation Apache Superset apache-superset PyPI
  • Medium 4.3
    CVE-2023-42505

    Apache Superset: Sensitive information disclosure on db connection details

    An authenticated user with read permissions on database connections metadata could potentially access sensitive information such as the connection's username. This issue affects Apache Superset before 3.0.0.

    Apache Software Foundation Apache Superset apache-superset PyPI

Revision history

  1. #1

    Initiale Fassung

References