CVE-2020-1932

2020-01-2800:38:15

apache

www.cve.org

AI Score

6.2

Confidence

High

EPSS

0.001

Percentile

17.3%

JSON

An information disclosure issue was found in Apache Superset 0.34.0, 0.34.1, 0.35.0, and 0.35.1. Authenticated Apache Superset users are able to retrieve other users’ information, including hashed passwords, by accessing an unused and undocumented API endpoint on Apache Superset.

CNA Affected

[
  {
    "product": "Apache Superset",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "status": "affected",
        "version": "0.34.0"
      },
      {
        "status": "affected",
        "version": "0.34.1"
      },
      {
        "status": "affected",
        "version": "0.35.0"
      },
      {
        "status": "affected",
        "version": "0.35.1"
      }
    ]
  }
]