Skip to content
OpenAdvisories
Medium · 4.3 CVE-2023-36388 BIT-superset-2023-36388EUVD-2023-2417GHSA-4fg9-5w46-xmrjPYSEC-2026-1159

Apache Superset: Improper API permission for low privilege users allows for SSRF

Published Sep 6, 2023 · Updated Sep 26, 2024 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Superset Package: apache-superset Ecosystem: PyPI

Description

Improper REST API permission in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma users to test network connections, possible SSRF.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Superset ≤ 2.1.0 —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI apache-superset <= 2.1.0 — GHSA-4fg9-5w46-xmrj
PyPI apache-superset < 2.1.1 2.1.1 PYSEC-2026-1159

References