GitHub Advisoryadvisory · PyPI

GHSA-748r-5r8q-273m Apache Superset allows authenticated users to access metadata they have no permission to

MEDIUM Published 2022-07-07 Modified 2023-09-05 Official page ↗
Aliases
CVE-2021-37839
Ecosystem
PyPI
Packages
apache-superset
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-273
Reviewed
2022-07-15

Affected packages

• PyPI apache-superset: < 1.5.1 → fixed in 1.5.1

Description

Apache Superset up to 1.5.1 allowed for authenticated users to access metadata information related to datasets they have no permission on. This metadata included the dataset name, columns and metrics.

Related

Alias · CVE (1)

  • CVE-2021-37839 Apache Superset up to 1.5.1 allowed for authenticated users to access metadata information related to datasets they have no permission on. vulnerability

Weakness · CWE (1)

  • CWE-273 Improper Check for Dropped Privileges weakness

References