GitHub Advisoryadvisory · PyPI

GHSA-cpvx-2365-466c Apache Superset may expose internal traces on REST API endpoints

MEDIUM Published 2023-09-06 Modified 2023-09-08 Official page ↗
Aliases
CVE-2023-39264
Ecosystem
PyPI
Packages
apache-superset
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-209
Reviewed
2023-09-08

Affected packages

• PyPI apache-superset: <= 2.1.0 (no fix yet)

Description

By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vulnerability exists in Apache Superset versions up to and including 2.1.0.

Related

Alias · CVE (1)

  • CVE-2023-39264 By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. vulnerability

Weakness · CWE (1)

  • CWE-209 Generation of Error Message Containing Sensitive Information weakness

References