Lucene search

GoogleOSV:GHSA-M6JM-3V38-76J4

HistoryFeb 28, 2024 - 12:30 p.m.

Apache Superset: Improper Neutralization of custom SQL on embedded context

2024-02-2812:30:26

Google

osv.dev

apache superset

sql injection

security patch

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

7.5

Confidence

High

EPSS

Percentile

9.0%

JSON

A guest user could exploit a chart data REST API and send arbitrary SQL statements that on error could leak information from the underlying analytics database.This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1.

Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue.

References

www.openwall.com/lists/oss-security/2024/02/28/5

github.com/apache/superset

lists.apache.org/thread/gfl3ckwy6y9tpz9jmpv62orh2q346sn5

nvd.nist.gov/vuln/detail/CVE-2024-24772

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

7.5

Confidence

High

EPSS

Percentile

9.0%

JSON

Related for OSV:GHSA-M6JM-3V38-76J4