Lucene search

GoogleOSV:CVE-2023-42501

HistoryNov 27, 2023 - 11:15 a.m.

CVE-2023-42501

2023-11-2711:15:07

Google

osv.dev

apache superset

unnecessary permissions

gamma role

css templates

annotations

upgrade

security issue

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

4.5

Confidence

High

EPSS

0.001

Percentile

48.1%

JSON

Unnecessary read permissions within the Gamma role would allow authenticated users to read configured CSS templates and annotations.
This issue affects Apache Superset: before 2.1.2.
Users should upgrade to version or above 2.1.2 and run superset init to reconstruct the Gamma role or remove can_read permission from the mentioned resources.

References

www.openwall.com/lists/oss-security/2023/11/27/3

lists.apache.org/thread/vk1rmrh9kz0chjmc9tk7o3md6zpz4ygh

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

4.5

Confidence

High

EPSS

0.001

Percentile

48.1%

JSON

Related for OSV:CVE-2023-42501