Lucene search

ApacheCVE-2020-1932

HistoryJan 28, 2020 - 1:15 a.m.

CVE-2020-1932

2020-01-2801:15:12

apache

web.nvd.nist.gov

109

apache superset

cve-2020-1932

information disclosure

security

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.1

Confidence

High

EPSS

0.001

Percentile

17.3%

JSON

An information disclosure issue was found in Apache Superset 0.34.0, 0.34.1, 0.35.0, and 0.35.1. Authenticated Apache Superset users are able to retrieve other users’ information, including hashed passwords, by accessing an unused and undocumented API endpoint on Apache Superset.

Affected configurations

Nvd

Vulners

Node

apachesupersetMatch0.34.0-

apachesupersetMatch0.34.1

apachesupersetMatch0.35.0

apachesupersetMatch0.35.1

VendorProductVersionCPE
apachesuperset0.34.0cpe:2.3:a:apache:superset:0.34.0:-:*:*:*:*:*:*
apachesuperset0.34.1cpe:2.3:a:apache:superset:0.34.1:*:*:*:*:*:*:*
apachesuperset0.35.0cpe:2.3:a:apache:superset:0.35.0:*:*:*:*:*:*:*
apachesuperset0.35.1cpe:2.3:a:apache:superset:0.35.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
apache	superset	0.34.0	cpe:2.3:a:apache:superset:0.34.0:-::::::
apache	superset	0.34.1	cpe:2.3:a:apache:superset:0.34.1:::::::*
apache	superset	0.35.0	cpe:2.3:a:apache:superset:0.35.0:::::::*
apache	superset	0.35.1	cpe:2.3:a:apache:superset:0.35.1:::::::*

CNA Affected

[
  {
    "product": "Apache Superset",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "status": "affected",
        "version": "0.34.0"
      },
      {
        "status": "affected",
        "version": "0.34.1"
      },
      {
        "status": "affected",
        "version": "0.35.0"
      },
      {
        "status": "affected",
        "version": "0.35.1"
      }
    ]
  }
]

References

lists.apache.org/thread.html/r4e5323c3bc786005495311a6ff53ac6d990b2c7eb52941a1a13ce227%40%3Cdev.superset.apache.org%3E

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.1

Confidence

High

EPSS

0.001

Percentile

17.3%

JSON

Related for CVE-2020-1932