Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access

🗓️ 12 Dec 2024 15:31:09Reported by GitHub Advisory DatabaseType

Improper authorization in Apache Superset allows unauthorized write access via SQLLab queries.

Reporter	Title	Published	Views	Family All 16
BDU FSTEC	The vulnerability of the Apache Superset data visualization software lies in its authentication procedures’ flaws, which allow unauthorized users to gain unauthorized access to read, modify, or delete data.	19 Dec 202400:00	–	bdu_fstec
Circl	CVE-2024-55633	12 Dec 202414:41	–	circl
CNNVD	Apache Superset 安全漏洞	12 Dec 202400:00	–	cnnvd
CVE	CVE-2024-55633	12 Dec 202414:36	–	cve
Cvelist	CVE-2024-55633 Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access	12 Dec 202414:36	–	cvelist
EUVD	EUVD-2024-3442	3 Oct 202520:07	–	euvd
NVD	CVE-2024-55633	12 Dec 202415:15	–	nvd
OSV	BIT-SUPERSET-2024-55633 Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access	5 Feb 202507:24	–	osv
OSV	GHSA-787V-V9VQ-4RGV Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access	12 Dec 202415:31	–	osv
OSV	PYSEC-2026-1162 Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access	7 Jul 202614:34	–	osv

Vulners

Node

apache-supersetRange<4.1.0pip

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-55633
lists	www.lists.apache.org/thread/bwmd17fcvljt9q4cgctp4v09zh3qs7fb
openwall	www.openwall.com/lists/oss-security/2024/12/12/1
github	www.github.com/advisories/GHSA-787v-v9vq-4rgv

11 Feb 2025 17:38Current

7.5High risk

Vulners AI Score7.5

CVSS 3.16.5

CVSS 47.1

EPSS0.02562

SSVC