1019 matches found
CVE-2024-28148 Apache Superset: Incorrect datasource authorization on explore REST API
An authenticated user could potentially access metadata for a datasource they are not authorized to view by submitting a targeted REST API request.This issue affects Apache Superset: before 3.1.2. Users are recommended to upgrade to version 3.1.2 or above, which fixes the issue...
Apache Superset 安全漏洞
Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. A security vulnerability exists in Apache Superset versions prior to 3.1.2, which can be exploited by an authenticated attacker to access metadata from data sources they are not authorized to vie...
PT-2024-22297
Name of the Vulnerable Software and Affected Versions Apache Superset versions prior to 3.1.2 Description An authenticated user could potentially access metadata for a datasource they are not authorized to view by submitting a targeted REST API request. Recommendations For versions prior to 3.1.2...
Apache Superset < 2.1.0 Hardcoded Secret Key
Apache Superset versions prior to 2.1.0 uses a default secret to sign cookies. An unauthenticated attacker can use this default value to forge a cookie and authenticate himself as administrator. No source data...
Apache Superset Resource Management Error Vulnerability (CNVD-2024-14775)
Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. A resource management error vulnerability exists in Apache Superset versions 2.1.2 and earlier, 3.0.0, and 3.0.1, which stems from uncontrolled resource consumption by the application, and can be...
Apache Superset SQL Injection Vulnerability (CNVD-2024-26537)
Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. Apache Superset suffers from a SQL injection vulnerability that can be exploited by an attacker to view, add, modify, or delete information in the back-end database by sending carefully crafted S...
Unspecified Vulnerability in Apache Superset (CNVD-2024-26186)
Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. Apache Superset suffers from a security vulnerability that originates from the ability of an authenticated user to generate specially crafted SQL statements to trigger database errors and expose...
Apache Superset Security Bypass Vulnerability (CNVD-2024-26536)
Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. Apache Superset suffers from an information disclosure vulnerability that is caused by incorrect authorization validation on dashboard and chart imports. An attacker could use this vulnerability ...
Apache Superset Information Disclosure Vulnerability (CNVD-2024-26535)
Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. Apache Superset suffers from an information disclosure vulnerability that is caused by improper data authorization. An attacker could exploit this vulnerability to obtain sensitive information...
Apache Superset SQL Injection Vulnerability (CNVD-2024-26534)
Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. Apache Superset suffers from a SQL injection vulnerability that stems from the application's lack of validation of externally entered SQL statements. An attacker can exploit the vulnerability to...
Sensitive Information Disclosure
Apache Superset is vulnerable to Sensitive Information Disclosure. The vulnerability is due to improper error handling when an authenticated user with privileges to create an Alerts generates a specially crafted SQL statement that triggers an error on the database which is not properly handled...
Incorrect Authorization
Apache Superset is vulnerable to Incorrect Authorization. The vulnerability is due to improper access check where a low privilege authenticated user could import an existing dashboard or chart that they do not have access to and then modify its metadata, thereby gaining ownership of the object...
Improper Authorization
apache-superset is vulnerable to Improper Authorization. The vulnerability is due to a user with custom roles that include can write on dataset which allows them to create virtual datasets to data they don't have access to. These users could then use those virtual datasets to get access to...
Improper Authorization
apache-superset is vulnerable to Improper Authorization. The vulnerability is due to improper parsing of nested SQL statements on SQLLab would allow authenticated users to surpass their data authorization...
Improper Neutralization
apache-superset is vulnerable for Improper Neutralization. The vulnerability is caused by a guest user sending syntactically incorrect SQL statements to the chart data rest api. When the API returns an error, sensitive analytic database information is leaked...
Apache Superset: Improper authorization validation on dashboards and charts import
A low privilege authenticated user could import an existing dashboard or chart that they do not have access to and then modify its metadata, thereby gaining ownership of the object. However, it's important to note that access to the analytical data of these charts and dashboards would still be...
Apache Superset: Improper data authorization when creating a new dataset
Apache Superset with custom roles that include can write on dataset and without all data access permissions, allows for users to create virtual datasets to data they don't have access to. These users could then use those virtual datasets to get access to unauthorized data. This issue affects Apac...
GHSA-WR6G-9WCR-CMQJ Apache Superset: Improper data authorization when creating a new dataset
Apache Superset with custom roles that include can write on dataset and without all data access permissions, allows for users to create virtual datasets to data they don't have access to. These users could then use those virtual datasets to get access to unauthorized data. This issue affects Apac...
GHSA-3V9R-885J-762G Apache Superset: Improper authorization validation on dashboards and charts import
A low privilege authenticated user could import an existing dashboard or chart that they do not have access to and then modify its metadata, thereby gaining ownership of the object. However, it's important to note that access to the analytical data of these charts and dashboards would still be...
Apache Superset: Improper Neutralization of custom SQL on embedded context
A guest user could exploit a chart data REST API and send arbitrary SQL statements that on error could leak information from the underlying analytics database.This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1 or 3.0.4, whi...