Skip to content
OpenAdvisories
Medium WID-SEC-2023-3184 4 CVEs

Apache Superset: Mehrere Schwachstellen

Published Dec 19, 2023 · Updated Feb 14, 2024 · Revision 2 · de-DE

Vendor: Apache Product: Superset Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in Apache Superset ausnutzen, um einen Denial of Service zu verursachen, Sicherheitseinstellungen zu umgehen und einen SQL-Injection Angriff durchzuführen.

Product

Apache Superset ist eine Open-Source-Plattform zur Datenexploration und -visualisierung.

Vulnerabilities 4

  • High 7.7
    CVE-2023-49734

    Apache Superset: Privilege Escalation Vulnerability

    An authenticated Gamma user has the ability to create a dashboard and add charts to it, this user would automatically become one of the owners of the charts allowing him to incorrectly have write permissions to these charts.This issue affects Apache Superset:…

    Apache Software Foundation Apache Superset apache-superset PyPI
  • Medium 6.5
    CVE-2023-46104

    Apache Superset: Allows for uncontrolled resource consumption via a ZIP bomb

    Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets.   This vulnerability exists in Apache Superset versions up to and including 2.1.2 and versions 3.0.0, 3.0.1.

    Apache Software Foundation Apache Superset apache-superset PyPI
  • Medium 6.5
    CVE-2023-49736

    Apache Superset: SQL Injection on where_in JINJA macro

    A where_in JINJA macro allows users to specify a quote, which combined with a carefully crafted statement would allow for SQL injection in Apache Superset.This issue affects Apache Superset: before 2.1.2, from 3.0.0 before 3.0.2. Users are recommended to upgr…

    Apache Software Foundation Apache Superset apache-superset PyPI
  • Medium 6.5
    CVE-2024-23952

    Apache Superset: Allows for uncontrolled resource consumption via a ZIP bomb (version range fix for CVE-2023-46104)

    This is a duplicate for CVE-2023-46104. With correct CVE version ranges for affected Apache Superset. Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets.   This …

    Apache Software Foundation Apache Superset

Revision history

  1. #2

    CVE ergänzt

  2. #1

    Initiale Fassung

References