Skip to content
OpenAdvisories

Package · PyPI

apache-superset

66 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

49 results · Clear filters · Feed

  • Medium 6.5
    CVE-2021-44451 Scanner template

    API sensitive information leak

    Apache Superset up to and including 1.3.2 allowed for registered database connections password leak for authenticated users. This information could be accessed in a non-trivial way. Users should upgrade to Apache Superset 1.4.0 or higher.

    Apache Software Foundation Apache Superset apache-superset PyPI
  • Medium 6.5
    CVE-2021-42250

    Possible log injection

    Improper output neutralization for Logs. A specific Apache Superset HTTP endpoint allowed for an authenticated user to forge log entries or inject malicious content into logs.

    Apache Software Foundation Apache Superset apache-superset PyPI
  • Medium 6.5
    CVE-2021-41972

    Credentials leak

    Apache Superset up to and including 1.3.1 allowed for database connections password leak for authenticated users. This information could be accessed in a non-trivial way.

    Apache Software Foundation Apache Superset apache-superset PyPI
  • Medium 5.4
    CVE-2021-32609

    XSS vulnerability on Explore page

    Apache Superset up to and including 1.1 does not sanitize titles correctly on the Explore page. This allows an attacker with Explore access to save a chart with a malicious title, injecting html (including scripts) into the page.

    Apache Software Foundation Apache Superset apache-superset PyPI
  • Medium 6.1
    CVE-2021-28125 EPSS 64%

    Apache Superset Open Redirect

    Apache Superset up to and including 1.0.1 allowed for the creation of an external URL that could be malicious. By not checking user input for open redirects the URL shortener functionality would allow for a malicious user to create a short URL for a dashboard…

    Apache Software Foundation Apache Superset apache-superset superset PyPI
  • Medium 5.4
    CVE-2021-27907 EPSS 86%

    Apache Superset stored XSS on Dashboard markdown

    Apache Superset up to and including 0.38.0 allowed the creation of a Markdown component on a Dashboard page for describing chart's related information. Abusing this functionality, a malicious user could inject javascript code executing unwanted action in the …

    Apache Software Foundation Apache Superset apache-superset PyPI
  • Medium 6.5
    CVE-2020-1932

    Information disclosure in Apache Superset

    An information disclosure issue was found in Apache Superset 0.34.0, 0.34.1, 0.35.0, and 0.35.1. Authenticated Apache Superset users are able to retrieve other users' information, including hashed passwords, by accessing an unused and undocumented API endpoin…

    Apache Software Foundation Apache Superset apache-superset PyPI
  • Medium 5.3
    CVE-2019-12413

    Users able to query database metadata in Apache Superset

    In Apache Incubator Superset before 0.31 user could query database metadata information from a database he has no access to, by using a specially crafted complex query.

    apache-superset PyPI
  • Medium 5.3
    CVE-2019-12414

    Users can view database names in Apache Superset

    In Apache Incubator Superset before 0.32, a user can view database names that he has no access to on a dropdown list in SQLLab

    apache-superset PyPI