GitHub Advisoryadvisory · PyPI

GHSA-35fc-9hrj-3585 Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled

HIGH Published 2024-12-09 Modified 2025-02-12 Official page ↗
Aliases
CVE-2024-53949
Ecosystem
PyPI
Packages
apache-superset
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-285, CWE-863
Reviewed
2024-12-09

Affected packages

• PyPI apache-superset: >= 2.0.0, < 4.1.0 → fixed in 4.1.0

Description

Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default). Allows for lower privilege users to use this API.  issue affects Apache Superset: from 2.0.0 before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue.

Related

Alias · CVE (1)

  • CVE-2024-53949 Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default). vulnerability

Weakness · CWE (2)

  • CWE-285 Improper Authorization weakness
  • CWE-863 Incorrect Authorization weakness

References