Lucene search

GoogleOSV:GHSA-VV65-FJFJ-4736

HistoryNov 27, 2023 - 12:30 p.m.

Apache Superset has Incorrect Default Permissions

2023-11-2712:30:55

Google

osv.dev

apache superset

default permissions

security

upgrade

gamma role

permissions

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

4.5

Confidence

High

EPSS

0.001

Percentile

48.1%

JSON

Unnecessary read permissions within the Gamma role would allow authenticated users to read configured CSS templates and annotations.
This issue affects Apache Superset: before 2.1.2.
Users should upgrade to version or above 2.1.2 and run superset init to reconstruct the Gamma role or remove can_read permission from the mentioned resources.

References

www.openwall.com/lists/oss-security/2023/11/27/3

github.com/apache/superset

lists.apache.org/thread/vk1rmrh9kz0chjmc9tk7o3md6zpz4ygh

nvd.nist.gov/vuln/detail/CVE-2023-42501

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

4.5

Confidence

High

EPSS

0.001

Percentile

48.1%

JSON

Related for OSV:GHSA-VV65-FJFJ-4736