GitHub Advisoryadvisory · PyPI

GHSA-fgpw-4w69-j256 Apache Superset Exposure of Sensitive Information to an Unauthorized Actor vulnerability

MEDIUM Published 2023-11-28 Modified 2025-02-13 Official page ↗
Aliases
CVE-2023-42505
Ecosystem
PyPI
Packages
apache-superset
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200
Reviewed
2023-11-28

Affected packages

• PyPI apache-superset: < 3.0.0 → fixed in 3.0.0

Description

An authenticated user with read permissions on database connections metadata could potentially access sensitive information such as the connection's username. This issue affects Apache Superset before 3.0.0.

Related

Alias · CVE (1)

  • CVE-2023-42505 An authenticated user with read permissions on database connections metadata could potentially access sensitive information such as the… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References