Skip to content
OpenAdvisories
Medium WID-SEC-2025-1851 4 CVEs

Apache Superset: Mehrere Schwachstellen

Published Aug 14, 2025 · Updated Aug 14, 2025 · de-DE

Vendor: Apache Product: Superset

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Apache Superset ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen und vertrauliche Informationen offenzulegen.

Product

Apache Superset ist eine Open-Source-Plattform zur Datenexploration und -visualisierung.

Vulnerabilities 4

  • Medium 5.3
    CVE-2025-55672

    Apache Superset: Stored XSS on charts metadata

    A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets execu…

    Apache Software Foundation Apache Superset apache-superset PyPI
  • Medium 5.3
    CVE-2025-55673

    Apache Superset: Metadata exposure in embedded charts

    When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names,…

    Apache Software Foundation Apache Superset apache-superset PyPI
  • Medium 5.3
    CVE-2025-55674

    Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions

    A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions …

    Apache Software Foundation Apache Superset apache-superset PyPI
  • Medium 5.3
    CVE-2025-55675

    Apache Superset: Incorrect datasource authorization on REST API

    Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do not have permission to access. By iterating through the datas…

    Apache Software Foundation Apache Superset apache-superset PyPI

Revision history

  1. #1

    Initiale Fassung

References