Description
In Apache Incubator Superset before 0.31 user could query database metadata information from a database he has no access to, by using a specially crafted complex query.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Apache Incubator Superset | Apache Incubator Superset 0.0.0 to 0.29.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | apache-superset | < 0.31.0 | 0.31.0 | GHSA-p5w7-qmq6-pmjr |
| PyPI | apache-superset | < 0.31 | 0.31 | PYSEC-2019-172 |