Code injection

Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets. This vulnerability exists in Apache Superset versions up to and including 2.1.2 and versions 3.0.0, 3.0.1...

Code injection

An authenticated Gamma user has the ability to create a dashboard and add charts to it, this user would automatically become one of the owners of the charts allowing him to incorrectly have write permissions to these charts.This issue affects Apache Superset: before 2.1.2, from 3.0.0 before 3.0.2...

CVE-2023-49734 Apache Superset: Privilege Escalation Vulnerability

An authenticated Gamma user has the ability to create a dashboard and add charts to it, this user would automatically become one of the owners of the charts allowing him to incorrectly have write permissions to these charts.This issue affects Apache Superset: before 2.1.2, from 3.0.0 before 3.0.2...

CVE-2023-49734 Apache Superset: Privilege Escalation Vulnerability

An authenticated Gamma user has the ability to create a dashboard and add charts to it, this user would automatically become one of the owners of the charts allowing him to incorrectly have write permissions to these charts.This issue affects Apache Superset: before 2.1.2, from 3.0.0 before 3.0.2...

CVE-2023-49734

Apache Superset is affected by an privilege-escalation vulnerability (CVE-2023-49734) where an authenticated Gamma user can create a dashboard, add charts, and automatically become an owner of those charts, gaining write permissions. Affected versions include the prior 2.1.x line (before 2.1.2) a...

CVE-2023-49736 Apache Superset: SQL Injection on where_in JINJA macro

A wherein JINJA macro allows users to specify a quote, which combined with a carefully crafted statement would allow for SQL injection in Apache Superset.This issue affects Apache Superset: before 2.1.2, from 3.0.0 before 3.0.2. Users are recommended to upgrade to version 3.0.2, which fixes the...

CVE-2023-49736 Apache Superset: SQL Injection on where_in JINJA macro

A wherein JINJA macro allows users to specify a quote, which combined with a carefully crafted statement would allow for SQL injection in Apache Superset.This issue affects Apache Superset: before 2.1.2, from 3.0.0 before 3.0.2. Users are recommended to upgrade to version 3.0.2, which fixes the...

CVE-2023-49736

CVE-2023-49736 describes a SQL injection vulnerability in Apache Superset caused by a vulnerable where_in JINJA macro. The issue allows an attacker to inject SQL via a quote parameter in the macro, with impact on confidentiality, integrity, and availability as described in the sources. Affected v...

CVE-2023-46104 Apache Superset: Allows for uncontrolled resource consumption via a ZIP bomb

Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets. This vulnerability exists in Apache Superset versions up to and including 2.1.2 and versions 3.0.0, 3.0.1...

CVE-2023-46104 Apache Superset: Allows for uncontrolled resource consumption via a ZIP bomb

Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets. This vulnerability exists in Apache Superset versions up to and including 2.1.2 and versions 3.0.0, 3.0.1...

CVE-2023-46104 Apache Superset: Allows for uncontrolled resource consumption via a ZIP bomb

Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets. This vulnerability exists in Apache Superset versions up to and including 2.1.2 and versions 3.0.0, 3.0.1...

CVE-2023-46104

CVE-2023-46104 affects Apache Superset up to v2.1.2 and v3.0.0–v3.0.1. Uncontrolled resource consumption can be triggered by an authenticated attacker who uploads a malicious ZIP to import databases, dashboards, or datasets. The CVSS base shows a Medium severity (6.5) with Network access, low att...

PT-2023-31315

Name of the Vulnerable Software and Affected Versions Apache Superset versions prior to 2.1.2 Apache Superset versions 3.0.0 through 3.0.1 Description A where in JINJA macro allows users to specify a quote, which combined with a carefully crafted statement would allow for SQL injection in Apache...

Apache Superset SQL注入漏洞

Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. Apache Superset suffers from a SQL injection vulnerability that can be exploited by an authenticated, remote attacker to send specially crafted SQL statements to the wherein JINJA macro...

Apache Superset 资源管理错误漏洞

Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. A denial of service vulnerability exists in Apache Superset, which can be exploited by an authenticated attacker to upload a malicious ZIP for importing databases, dashboards, or datasets,...

Apache Superset 安全漏洞

Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. Apache Superset suffers from an elevation of privilege vulnerability that can be exploited by an attacker to gain write access to all gauges in a dashboard via the Add Gauge function of Create...

PT-2023-29848

Name of the Vulnerable Software and Affected Versions Apache Superset versions up to and including 2.1.2 Apache Superset versions 3.0.0, 3.0.1 Description Uncontrolled resource consumption can be triggered by an authenticated attacker that uploads a malicious ZIP to import database, dashboards, o...

Apache Superset < 2.1.0 Secure Session Key

The version of Apache Superset installed on the remote host is affected a potential unsecure session key vulnerability. Installations that have not altered the default configured SECRETKEY according to the installation instructions, or that use a predictable key phrase, would allow for an...

Apache Superset Cross-Site Scripting Vulnerability (CNVD-2023-9665948)

Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. A cross-site scripting vulnerability exists in Apache Superset versions prior to 2.1.2, which stems from the presence of incorrect payload validation and incorrect REST API response type issues. ...

Apache Superset Authorization Issues Vulnerability (CNVD-2023-9666047)

Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. An authorization issue vulnerability exists in Apache Superset versions prior to 2.1.2 that stems from the presence of incorrect authorization checks. An attacker could exploit this vulnerability...