CVE-2024-55633

Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access

Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML statement that is Incorrectly identified as a read-only query, enabling its execution. Non postgres analytics database connections and postgres analytics database connections set with a readonly user (advised) are not vulnerable.  This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue.

CVSS 4.0 · 7.1 High EPSS 2.8% KEV · Not listed

Vendors

Apache

Products

Superset

CVE-2024-53949

Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled

Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default). Allows for lower privilege users to use this API.  issue affects Apache Superset: from 2.0.0 before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Superset

CVE-2024-24772

Apache Superset: Improper Neutralisation of custom SQL on embedded context

A guest user could exploit a chart data REST API and send arbitrary SQL statements that on error could leak information from the underlying analytics database.This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Superset

CVE-2024-28148

Apache Superset: Incorrect datasource authorization on explore REST API

An authenticated user could potentially access metadata for a datasource they are not authorized to view by submitting a targeted REST API request.This issue affects Apache Superset: before 3.1.2. Users are recommended to upgrade to version 3.1.2 or above, which fixes the issue.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Superset

CVE-2024-53948

Apache Superset: Error verbosity exposes metadata in analytics databases

Generation of Error Message Containing analytics metadata Information in Apache Superset. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Superset

CVE-2024-27315

Apache Superset: Improper error handling on alerts

An authenticated user with privileges to create Alerts on Alerts & Reports has the capability to generate a specially crafted SQL statement that triggers an error on the database. This error is not properly handled by Apache Superset and may inadvertently surface in the error log of the Alert exposing possibly sensitive data. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Superset

CVE-2023-43701

Apache Superset: Stored XSS on API endpoint

Improper payload validation and an improper REST API response type, made it possible for an authenticated malicious actor to store malicious code into Chart's metadata, this code could get executed if a user specifically accesses a specific deprecated API endpoint. This issue affects Apache Superset versions prior to 2.1.2.  Users are recommended to upgrade to version 2.1.2, which fixes this issue.

CVSS 3.1 · 4.3 Medium EPSS 1.0% KEV · Not listed

Vendors

Apache

Products

Superset

CVE-2023-42502

Apache Superset: Open Redirect Vulnerability

An authenticated attacker with update datasets permission could change a dataset link to an untrusted site by spoofing the HTTP Host header, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset versions before 3.0.0.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Superset

CVE-2023-39264

Apache Superset: Stack traces enabled by default

By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vulnerability exists in Apache Superset versions up to and including 2.1.0.

CVSS 3.1 · 4.3 Medium EPSS 1.1% KEV · Not listed

Vendors

Apache

Products

Superset

CVE-2023-36388

Apache Superset: Improper API permission for low privilege users allows for SSRF

Improper REST API permission in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma users to test network connections, possible SSRF.

CVSS 3.1 · 4.3 Medium EPSS 1.1% KEV · Not listed

Vendors

Apache

Products

Superset

CVE-2023-36387

Apache Superset: Improper API permission for low privilege users

An improper default REST API permission for Gamma users in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma user to test database connections.

CVSS 3.1 · 5.4 Medium EPSS 1.1% KEV · Not listed

Vendors

Apache

Products

Superset

CVE-2023-32672

Apache Superset: SQL parser edge case bypasses data access authorization

An Incorrect authorisation check in SQLLab in Apache Superset versions up to and including 2.1.0. This vulnerability allows an authenticated user to query tables that they do not have proper access to within Superset. The vulnerability can be exploited by leveraging a SQL parsing vulnerability.

CVSS 3.1 · 4.3 Medium EPSS 1.0% KEV · Not listed

Vendors

Apache

Products

Superset

CVE-2023-30776

Apache Superset: Database connection password leak

An authenticated user with specific data permissions could access database connections stored passwords by requesting a specific REST API. This issue affects Apache Superset version 1.3.0 up to 2.0.1.

CVSS 3.1 · 4.9 Medium EPSS 2.1% KEV · Not listed

Vendors

Apache

Products

Superset

CVE-2023-27526

Apache Superset: Improper Authorization check on import charts

A non Admin authenticated user could incorrectly create resources using the import charts feature, on Apache Superset up to and including 2.1.0. 

CVSS 3.1 · 4.3 Medium EPSS 1.2% KEV · Not listed

Vendors

Apache

Products

Superset

CVE-2023-27525

Apache Superset: Incorrect default permissions for Gamma role

An authenticated user with Gamma role authorization could have access to metadata information using non trivial methods in Apache Superset up to and including 2.0.1

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Superset

CVE-2023-27523

Apache Superset: Improper data permission validation on Jinja templated queries

Improper data authorization check on Jinja templated queries in Apache Superset up to and including 2.1.0 allows for an authenticated user to issue queries on database tables they may not have access to.

CVSS 3.1 · 5 Medium EPSS 1.0% KEV · Not listed

Vendors

Apache

Products

Superset

CVE-2022-27479

SQL injection vulnerability in chart data API

Apache Superset before 1.4.2 is vulnerable to SQL injection in chart data requests. Users should update to 1.4.2 or higher which addresses this issue.

CVSS 3.1 · 9.8 Critical EPSS 2.9% KEV · Not listed

Vendors

Apache

Products

Superset

CVE-2021-44451

API sensitive information leak

Apache Superset up to and including 1.3.2 allowed for registered database connections password leak for authenticated users. This information could be accessed in a non-trivial way. Users should upgrade to Apache Superset 1.4.0 or higher.

CVSS 3.1 · 6.5 Medium EPSS 7.9% KEV · Not listed

Vendors

Apache

Products

Superset

CVE-2021-42250

Possible log injection

Improper output neutralization for Logs. A specific Apache Superset HTTP endpoint allowed for an authenticated user to forge log entries or inject malicious content into logs.

CVSS 3.1 · 6.5 Medium EPSS 1.8% KEV · Not listed

Vendors

Apache

Products

Superset

CVE-2021-41972

Credentials leak

Apache Superset up to and including 1.3.1 allowed for database connections password leak for authenticated users. This information could be accessed in a non-trivial way.

CVSS 3.1 · 6.5 Medium EPSS 1.5% KEV · Not listed

Vendors

Apache

Products

Superset