Lucene search

GitHub Advisory DatabaseGHSA-299Q-3P96-5898

HistoryMay 07, 2024 - 3:30 p.m.

Apache Superset Incorrect Authorization vulnerability

2024-05-0715:30:36

CWE-863

GitHub Advisory Database

github.com

apache superset

incorrect authorization

vulnerability

version 3.1.2

rest api

metadata

datasource

upgrade

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

4.5

Confidence

High

EPSS

Percentile

9.0%

JSON

An authenticated user could potentially access metadata for a datasource they are not authorized to view by submitting a targeted REST API request. This issue affects Apache Superset before 3.1.2.

Users are recommended to upgrade to version 3.1.2 or above, which fixes the issue.

Affected configurations

Vulners

Node

apachesupersetRange<3.1.2

References

github.com/advisories/GHSA-299q-3p96-5898

lists.apache.org/thread/n27wlbd05oc6bgjh28d5pxzsrrph8dgo

nvd.nist.gov/vuln/detail/CVE-2024-28148

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

4.5

Confidence

High

EPSS

Percentile

9.0%

JSON

Related for GHSA-299Q-3P96-5898