GitHub Advisoryadvisory · PyPI

GHSA-fj4x-m62j-wvwg Apache Superset Deserialization of Untrusted Data vulnerability

MEDIUM Published 2023-09-06 Modified 2025-02-13 Official page ↗
Aliases
CVE-2023-37941
Ecosystem
PyPI
Packages
apache-superset
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2023-09-08

Affected packages

• PyPI apache-superset: >= 1.5.0, < 2.1.1 → fixed in 2.1.1

Description

If an attacker gains write access to the Apache Superset metadata database, they could persist a specifically crafted Python object that may lead to remote code execution on Superset's web backend. The Superset metadata db is an 'internal' component that is typically only accessible directly by the system administrator and the superset process itself. Gaining access to that database should be difficult and require significant privileges. This vulnerability impacts Apache Superset versions 1.5.0 up to and including 2.1.0. Users are recommended to upgrade to version 2.1.1 or later.

Related

Alias · CVE (1)

  • CVE-2023-37941 If an attacker gains write access to the Apache Superset metadata database, they could persist a specifically crafted Python object that… vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References