CVE-2023-42505

CVE-2023-42505 affects Apache Superset prior to 3.0.0. An authenticated user with read permissions on database connections metadata could access sensitive information such as the connection username. The connected documents confirm the affected product and impact but do not provide exploit detail...

CVE-2023-42505 Apache Superset: Sensitive information disclosure on db connection details

An authenticated user with read permissions on database connections metadata could potentially access sensitive information such as the connection's username. This issue affects Apache Superset before 3.0.0...

CVE-2023-42505 Apache Superset: Sensitive information disclosure on db connection details

An authenticated user with read permissions on database connections metadata could potentially access sensitive information such as the connection's username. This issue affects Apache Superset before 3.0.0...

PT-2023-28379

Name of the Vulnerable Software and Affected Versions Apache Superset versions prior to 3.0.0 Description The issue allows an authenticated user with read permissions on database connections metadata to potentially access sensitive information, such as the connection's username. Recommendations F...

The vulnerability of the application software interface for data visualization software Apache Superset allows a hacker to probe connections with the database.

The vulnerability of the application software interface for data visualization in Apache Superset is related to deficiencies in the authentication mechanism. Exploiting this vulnerability allows a malicious actor to remotely check database connections...

GHSA-FM4Q-J8G4-C9J4 Apache Superset Improper Input Validation vulnerability

Apache Superset would allow for SQLite database connections to be incorrectly registered when an attacker uses alternative driver names like sqlite+pysqlite or by using database imports. This could allow for unexpected file creation on Superset webservers. Additionally, if Apache Superset is usin...

Apache Superset has improper default REST API permission for Gamma users

An improper default REST API permission for Gamma users in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma user to test database connections...

Design/Logic Flaw

Apache Superset would allow for SQLite database connections to be incorrectly registered when an attacker uses alternative driver names like sqlite+pysqlite or by using database imports. This could allow for unexpected file creation on Superset webservers. Additionally, if Apache Superset is usin...

CVE-2023-36387

An improper default REST API permission for Gamma users in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma user to test database connections...

Input validation

An improper default REST API permission for Gamma users in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma user to test database connections...

CVE-2023-39265

CVE-2023-39265 : Multiple connected documents describe a vulnerability in Apache Superset where SQLite database connections can be registered incorrectly when using alternative driver names (e.g., sqlite+pysqlite) or via database imports. This may allow arbitrary file creation on Superset webserv...

CVE-2023-39265 Apache Superset: Possible Unauthorized Registration of SQLite Database Connections

Apache Superset would allow for SQLite database connections to be incorrectly registered when an attacker uses alternative driver names like sqlite+pysqlite or by using database imports. This could allow for unexpected file creation on Superset webservers. Additionally, if Apache Superset is usin...

CVE-2023-36387

CVE-2023-36387 affects Apache Superset up to version 2.1.0. The issue is an improper default REST API permission that allows an authenticated Gamma user to test a database connection. The available connected documents corroborate this risk across multiple sources (e.g., Red Hat, OSV, CNVD-like re...

CVE-2023-36387 Apache Superset: Improper API permission for low privilege users

An improper default REST API permission for Gamma users in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma user to test database connections...

CVE-2023-36387 Apache Superset: Improper API permission for low privilege users

An improper default REST API permission for Gamma users in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma user to test database connections...

PT-2023-6899

Name of the Vulnerable Software and Affected Versions Apache Superset versions up to and including 2.1.0 Description The issue is related to an improper default REST API permission for Gamma users in Apache Superset, which is connected to shortcomings in the authorization mechanism. This allows a...

GHSA-CMJC-52FG-9F7J Apache Superset vulnerable to Exposure of Sensitive Information

An authenticated user with specific data permissions could access database connections stored passwords by requesting a specific REST API. This issue affects Apache Superset version 1.3.0 up to 2.0.1...

Apache Superset vulnerable to Exposure of Sensitive Information

An authenticated user with specific data permissions could access database connections stored passwords by requesting a specific REST API. This issue affects Apache Superset version 1.3.0 up to 2.0.1...

CVE-2022-47880

An Information disclosure vulnerability in /be/rpc.php in Jedox GmbH Jedox 2020.2.5 allow remote, authenticated users with permissions to modify database connections to disclose a connections' cleartext password via the 'test connection' function...

Information disclosure

An Information disclosure vulnerability in /be/rpc.php in Jedox GmbH Jedox 2020.2.5 allow remote, authenticated users with permissions to modify database connections to disclose a connections' cleartext password via the 'test connection' function...