Lucene search

ApacheCVELIST:CVE-2023-42501

HistoryNov 27, 2023 - 10:23 a.m.

CVE-2023-42501 Apache Superset: Unnecessary read permissions within the Gamma role

2023-11-2710:23:47

CWE-276

apache

www.cve.org

cve-2023-42501

apache superset

gamma role

authenticated users

css templates

annotations

upgrade

version 2.1.2

superset init

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

4.8

Confidence

High

EPSS

0.001

Percentile

48.1%

JSON

Unnecessary read permissions within the Gamma role would allow authenticated users to read configured CSS templates and annotations.
This issue affects Apache Superset: before 2.1.2.
Users should upgrade to version or above 2.1.2 and run superset init to reconstruct the Gamma role or remove can_read permission from the mentioned resources.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache Superset",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "2.1.2",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

References

www.openwall.com/lists/oss-security/2023/11/27/3

lists.apache.org/thread/vk1rmrh9kz0chjmc9tk7o3md6zpz4ygh

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

4.8

Confidence

High

EPSS

0.001

Percentile

48.1%

JSON

Related for CVELIST:CVE-2023-42501