Medium · 5.4 CVE-2023-36387 BIT-superset-2023-36387EUVD-2023-2476GHSA-9832-mgg4-3gr6PYSEC-2026-1168

Apache Superset: Improper API permission for low privilege users

Published Sep 6, 2023 · Updated Sep 26, 2024 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Superset Package: apache-superset Ecosystem: PyPI

Description

An improper default REST API permission for Gamma users in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma user to test database connections.

Affected products

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache Superset	≤ 2.1.0	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
PyPI	apache-superset	<= 2.1.0	—	GHSA-9832-mgg4-3gr6

References

https://lists.apache.org/thread/tt6s6hm8nv6s11z8bfsk3r3d9ov0ogw3 vendor-advisory
https://github.com/apache/superset/pull/24185 patch

CNA	v3.1	5.4
EUVD	v3.1	5.4
OSV:GHSA	v3.1	5.4
OSV:PYSEC	v3.1	5.4