Lucene search
F5F5:K000138199HistoryJan 11, 2024 - 12:00 a.m.
K000138199 : Apache Superset vulnerability CVE-2023-27524
2024-01-1100:00:00
my.f5.com
16
apache superset
vulnerability
session validation
secret_key
authentication
unauthorized resources
cve-2023-27524
Security Advisory Description
Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config. (CVE-2023-27524)
Impact
There is no impact; F5 products are not affected by this vulnerability.
Related
cve
cve
CVE-2023-27524
2023-04-24 16:15:07
githubexploit
githubexploit
Exploit for Insecure Default Initialization of Resource in Apache Superset
2023-05-08 16:50:08
Exploit for Insecure Default Initialization of Resource in Apache Superset
2023-05-04 21:43:48
Exploit for Insecure Default Initialization of Resource in Apache Superset
2023-04-25 04:59:05
cisa_kev
cisa_kev
Apache Superset Insecure Default Initialization of Resource Vulnerability
2024-01-08 00:00:00
veracode
veracode
Authentication Bypass
2023-05-01 23:21:58
packetstorm
packetstorm
Apache Superset 2.0.0 Authentication Bypass
2023-05-24 00:00:00
Apache Superset 2.0.0 Remote Code Execution
2023-10-13 00:00:00
metasploit
metasploit
Apache Superset Signed Cookie Priv Esc
2023-09-11 14:33:43
Apache Superset Signed Cookie RCE
2023-09-13 19:26:29
nuclei
nuclei
Apache Superset - Authentication Bypass
2023-04-25 13:32:59
Piwigo 13.7.0 - SQL Injection
2023-07-12 04:51:18
github
github
Apache superset missing check for default SECRET_KEY
2023-04-24 18:30:30
nessus
nessus
Apache Superset Known Default SECRET_KEY (CVE-2023-27524)
2024-05-16 00:00:00
Apache Superset < 2.1.0 Secure Session Key
2023-12-01 00:00:00
prion
prion
Design/Logic Flaw
2023-04-24 16:15:00
attackerkb
attackerkb
CVE-2023-27524
2023-04-24 00:00:00
nvd
nvd
CVE-2023-27524
2023-04-24 16:15:07
osv
osv
Apache superset missing check for default SECRET_KEY
2023-04-24 18:30:30
CVE-2023-27524
2023-04-24 16:15:07
thn
thn
zdt
zdt
Apache Superset 2.0.0 - Authentication Bypass Exploit
2023-05-23 00:00:00
Apache Superset 2.0.0 Remote Code Execution Exploit
2023-10-15 00:00:00
cvelist
cvelist
exploitdb
exploitdb
Apache Superset 2.0.0 - Authentication Bypass
2023-05-23 00:00:00
rapid7blog
rapid7blog
Metasploit Weekly Wrap-Up
2023-09-15 18:54:45