Sensitive Information Disclosure

2024-02-2907:07:18

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

apache superset

vulnerability

error handling

sensitive data

sql statement

database

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

Confidence

Low

EPSS

Percentile

9.0%

JSON

Apache Superset is vulnerable to Sensitive Information Disclosure. The vulnerability is due to improper error handling when an authenticated user with privileges to create an Alerts generates a specially crafted SQL statement that triggers an error on the database which is not properly handled. This error may inadvertently surface in the error log of the Alert exposing sensitive data.