Skip to content
OpenAdvisories
Medium WID-SEC-2024-0515 5 CVEs

Apache Superset: Mehrere Schwachstellen ermöglichen Manipulation von Dateien

Published Feb 28, 2024 · Updated Feb 28, 2024 · de-DE

Vendor: Apache Product: Superset Platform: Linux Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Apache Superset ausnutzen, um Dateien zu manipulieren.

Product

Apache Superset ist eine Open-Source-Plattform zur Datenexploration und -visualisierung.

Vulnerabilities 5

  • Medium 5.0
    CVE-2024-24779

    Apache Superset: Improper data authorization when creating a new dataset

    Apache Superset with custom roles that include `can write on dataset` and without all data access permissions, allows for users to create virtual datasets to data they don't have access to. These users could then use those virtual datasets to get access to un…

    Apache Software Foundation Apache Superset apache-superset PyPI
  • Medium 4.9
    CVE-2024-24773

    Apache Superset: Improper validation of SQL statements allows for unauthorized access to data

    Improper parsing of nested SQL statements on SQLLab would allow authenticated users to surpass their data authorization scope. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1, which …

    Apache Software Foundation Apache Superset apache-superset PyPI
  • Medium 4.3
    CVE-2024-24772

    Apache Superset: Improper Neutralisation of custom SQL on embedded context

    A guest user could exploit a chart data REST API and send arbitrary SQL statements that on error could leak information from the underlying analytics database.This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to …

    Apache Software Foundation Apache Superset apache-superset PyPI
  • Medium 4.3
    CVE-2024-26016

    Apache Superset: Improper authorization validation on dashboards and charts import

    A low privilege authenticated user could import an existing dashboard or chart that they do not have access to and then modify its metadata, thereby gaining ownership of the object. However, it's important to note that access to the analytical data of these c…

    Apache Software Foundation Apache Superset apache-superset PyPI
  • Medium 4.3
    CVE-2024-27315

    Apache Superset: Improper error handling on alerts

    An authenticated user with privileges to create Alerts on Alerts & Reports has the capability to generate a specially crafted SQL statement that triggers an error on the database. This error is not properly handled by Apache Superset and may inadvertently sur…

    Apache Software Foundation Apache Superset apache-superset PyPI

Revision history

  1. #1

    Initiale Fassung

References