CVE-2024-24779 Apache Superset: Improper data authorization when creating a new dataset

2024-02-2811:28:02

CWE-863

apache

github.com

apache superset

data authorization

vulnerability

upgrade

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

AI Score

5.5

Confidence

High

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

Apache Superset with custom roles that include can write on dataset and without all data access permissions, allows for users to create virtual datasets to data they don’t have access to. These users could then use those virtual datasets to get access to unauthorized data.
This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1.

Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue.

CNA Affected

[
  {
    "vendor": "Apache Software Foundation",
    "product": "Apache Superset",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "3.0.4",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "3.1.0",
        "lessThan": "3.1.1",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]