GitHub Advisoryadvisory · PyPI

GHSA-fxjg-28fm-pfxh Apache Superset Server-Side Request Forgery vulnerability

MEDIUM Published 2023-07-06 Modified 2025-02-13 Official page ↗
Aliases
CVE-2023-25504
Ecosystem
PyPI
Packages
apache-superset
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-918
Reviewed
2023-07-06

Affected packages

• PyPI apache-superset: < 2.1.0 → fixed in 2.1.0

Description

A malicious actor who has been authenticated and granted specific permissions in Apache Superset may use the import dataset feature in order to conduct Server-Side Request Forgery attacks and query internal resources on behalf of the server where Superset is deployed. This vulnerability exists in Apache Superset versions up to and including 2.0.1.

Related

Alias · CVE (1)

  • CVE-2023-25504 A malicious actor who has been authenticated and granted specific permissions in Apache Superset may use the import dataset feature in… vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References