Information Disclosure

apache_superset is vulnerable to Information Disclosure. A remote authenticated attacker with read access to a specific database can add subqueries to the WHERE and HAVING fields, resulting in references to tables on the same database that the attacker should not have access to. The perimeter to prevent ad-hoc queries (ALLOW_ADHOC_SUBQUERY) fails to sanitize the WHERE and HAVING fields, resulting in the disclosure of Sensitive Information.