GitHub Advisoryadvisory · PyPI

GHSA-5474-f7g5-273q Apache Superset: Improper validation of SQL statements allows for unauthorized access to data

MEDIUM Published 2024-02-28 Modified 2025-02-13 Official page ↗
Aliases
CVE-2024-24773
Ecosystem
PyPI
Packages
apache-superset
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-863
Reviewed
2024-02-28

Affected packages

• PyPI apache-superset: < 3.0.4 → fixed in 3.0.4 • PyPI apache-superset: >= 3.1.0, < 3.1.1 → fixed in 3.1.1

Description

Improper parsing of nested SQL statements on SQLLab would allow authenticated users to surpass their data authorization scope. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1, which fixes the issue.

Related

Alias · CVE (1)

  • CVE-2024-24773 Improper parsing of nested SQL statements on SQLLab would allow authenticated users to surpass their data authorization scope. vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References