Apache Superset vulnerable to Exposure of Sensitive Information

2023-07-0619:24:19

Google

osv.dev

sensitive information

authentication

database connections

rest api

software vulnerability

0.001 Low

EPSS

Percentile

29.2%

JSON

An authenticated user with specific data permissions could access database connections stored passwords by requesting a specific REST API. This issue affects Apache Superset version 1.3.0 up to 2.0.1.

CPENameOperatorVersion
apache-superseteq1.3.1
apache-superseteq1.4.2
apache-superseteq1.5.2
apache-superseteq2.0.0
apache-superseteq1.5.3
apache-superseteq2.0.1
apache-superseteq1.4.0
apache-superseteq1.4.1
apache-superseteq1.3.0
apache-superseteq1.3.2

Name	Operator	Version
apache-superset	eq	1.3.1
apache-superset	eq	1.4.2
apache-superset	eq	1.5.2
apache-superset	eq	2.0.0
apache-superset	eq	1.5.3
apache-superset	eq	2.0.1
apache-superset	eq	1.4.0
apache-superset	eq	1.4.1
apache-superset	eq	1.3.0
apache-superset	eq	1.3.2