CVE-2025-55673

🗓️ 14 Aug 2025 13:16:27Reported by apacheType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 22 Views🌐 WEB

Guest users can view /chart/data payload exposing table names in the database; fix in 4.1.3.

Reporter	Title	Published	Views	Family All 15
Circl	CVE-2025-55673	14 Aug 202510:41	–	circl
CNNVD	Apache Superset 信息泄露漏洞	14 Aug 202500:00	–	cnnvd
CNVD	Apache Superset Information Disclosure Vulnerability (CNVD-2025-19102)	20 Aug 202500:00	–	cnvd
Cvelist	CVE-2025-55673 Apache Superset: Metadata exposure in embedded charts	14 Aug 202513:16	–	cvelist
EUVD	EUVD-2025-24807	3 Oct 202520:07	–	euvd
Github Security Blog	Apache Superset data query improperly discloses database schema information to low-privileged guest user	14 Aug 202515:30	–	github
NVD	CVE-2025-55673	14 Aug 202514:15	–	nvd
OSV	BIT-SUPERSET-2025-55673 Apache Superset: Metadata exposure in embedded charts	18 Aug 202508:13	–	osv
OSV	CGA-GVJH-3GCW-5877	29 Jan 202600:47	–	osv
OSV	GHSA-9G5X-MM39-WG9R Apache Superset data query improperly discloses database schema information to low-privileged guest user	14 Aug 202515:30	–	osv

NVD

Vulners

Node

apache supersetRange<4.1.3

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache Superset",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "4.1.3",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
lists	www.lists.apache.org/thread/h2hw756wk4sj4z49blvzkr5fntl9hlf8
openwall	www.openwall.com/lists/oss-security/2025/08/14/3

Parameter	Position	Path	Description	CWE
query	nested	/chart/data	Endpoint /chart/data exposes underlying SQL query in its response payload, leaking database schema information to guest users.	CWE-200

04 Nov 2025 22:16Current

7.1High risk

Vulners AI Score7.1

CVSS 3.14.3

CVSS 45.3

EPSS0.00329

SSVC

CWE-200