Lucene search

GitHub Advisory DatabaseGHSA-95CH-P3GW-23QG

HistorySep 06, 2023 - 3:30 p.m.

Apache Superset has incorrect authorization check

2023-09-0615:30:27

CWE-863

GitHub Advisory Database

github.com

apache superset

sqllab

authorization

vulnerability

sql parsing

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

47.0%

JSON

An Incorrect authorisation check in SQLLab in Apache Superset versions up to and including 2.1.0. This vulnerability allows an authenticated user to query tables that they do not have proper access to within Superset. The vulnerability can be exploited by leveraging a SQL parsing vulnerability.

Affected configurations

Vulners

Node

apachesupersetRange≤2.1.0

VendorProductVersionCPE
apachesuperset*cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
apache	superset	*	cpe:2.3:a:apache:superset::::::::

References

github.com/advisories/GHSA-95ch-p3gw-23qg

lists.apache.org/thread/ococ6nlj80f0okkwfwpjczy3q84j3wkp

nvd.nist.gov/vuln/detail/CVE-2023-32672

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

47.0%

JSON

Related for GHSA-95CH-P3GW-23QG