Description
An authenticated user could potentially access metadata for a datasource they are not authorized to view by submitting a targeted REST API request.This issue affects Apache Superset: before 3.1.2.
Users are recommended to upgrade to version 3.1.2 or above, which fixes the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Superset | < 3.1.2 | 3.1.2 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | apache-superset | < 3.1.2 | 3.1.2 | GHSA-299q-3p96-5898 |
Advisories 1
- WID-SEC-2024-1059 Apache Superset: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · May 7, 2024
References
- https://lists.apache.org/thread/n27wlbd05oc6bgjh28d5pxzsrrph8dgo vendor-advisory