Skip to content
OpenAdvisories
High WID-SEC-2024-3641 3 CVEs

Apache Superset: Mehrere Schwachstellen

Published Dec 9, 2024 · Updated Dec 9, 2024 · de-DE

Vendor: Apache Product: Superset

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Apache Superset ausnutzen, um sich erweiterte Rechte zu verschaffen, Daten zu manipulieren und Metadaten aus Analysedatenbanken offenzulegen.

Product

Apache Superset ist eine Open-Source-Plattform zur Datenexploration und -visualisierung.

Vulnerabilities 3

  • High 7.6
    CVE-2024-53949

    Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled

    Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default). Allows for lower privilege users to use this API.  issue affects Apache Superset: from 2.0.0 before 4.1.0. Users are recommended to upgrade to …

    Apache Software Foundation Apache Superset apache-superset PyPI
  • Medium 5.3
    CVE-2024-53948

    Apache Superset: Error verbosity exposes metadata in analytics databases

    Generation of Error Message Containing analytics metadata Information in Apache Superset. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue.

    Apache Software Foundation Apache Superset apache-superset PyPI
  • Low 2.3
    CVE-2024-53947

    Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Superset. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. This …

    Apache Software Foundation Apache Superset apache-superset PyPI

Revision history

  1. #1

    Initiale Fassung

References