Skip to content
OpenAdvisories
Medium · 5.3 CVE-2019-12414 EUVD-2019-0019GHSA-9c29-9h4m-wg5pPYSEC-2019-173

Users can view database names in Apache Superset

Published Dec 16, 2019 · Updated Aug 4, 2024 · Assigned by apache

Package: apache-superset Ecosystem: PyPI

Description

In Apache Incubator Superset before 0.32, a user can view database names that he has no access to on a dropdown list in SQLLab

Affected products

VendorProductAffectedFixed
— Apache Incubator Superset Apache Incubator Superset 0.0.0 to 0.31.0 —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI apache-superset < 0.32.0 0.32.0 GHSA-9c29-9h4m-wg5p
PyPI apache-superset < 0.32 0.32 PYSEC-2019-173

References