GitHub Advisoryadvisory · PyPI

GHSA-9832-mgg4-3gr6 Apache Superset has improper default REST API permission for Gamma users

MEDIUM Published 2023-09-06 Modified 2023-09-07 Official page ↗
Aliases
CVE-2023-36387
Ecosystem
PyPI
Packages
apache-superset
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Weaknesses
CWE-281, CWE-863, CWE-918
Reviewed
2023-09-07

Affected packages

• PyPI apache-superset: <= 2.1.0 (no fix yet)

Description

An improper default REST API permission for Gamma users in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma user to test database connections.

Related

Alias · CVE (1)

  • CVE-2023-36387 An improper default REST API permission for Gamma users in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma user… vulnerability

Weakness · CWE (3)

  • CWE-281 Improper Preservation of Permissions weakness
  • CWE-863 Incorrect Authorization weakness
  • CWE-918 Server-Side Request Forgery weakness

References