GitHub Advisory DatabaseGHSA-95MG-JGFX-54V9Apache Superset uncontrolled resource consumption
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
6.8 Medium
AI Score
Confidence
Low
0.001 Low
EPSS
Percentile
50.9%
Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets.
This vulnerability exists in Apache Superset versions up to and including 2.1.2 and versions 3.0.0, 3.0.1.
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| apache-superset | lt | 3.1.0rc1 | |
| apache-superset | lt | 2.1.2 |
References
www.openwall.com/lists/oss-security/2023/12/19/1
github.com/advisories/GHSA-95mg-jgfx-54v9
github.com/apache/superset/commit/7c23cb0b3fd224c320b35f05e74b572033569154
github.com/apache/superset/commit/f473d13d0d89de5990209ff81b17dfe2cee884d3
lists.apache.org/thread/yxbxg4wryb7cb7wyybk11l5nqy0rsrvl
nvd.nist.gov/vuln/detail/CVE-2023-46104
Related
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
6.8 Medium
AI Score
Confidence
Low
0.001 Low
EPSS
Percentile
50.9%