GitHub Advisoryadvisory · PyPI

GHSA-fxjm-wvj9-9c39 Information disclosure in Apache Superset

MEDIUM Published 2020-02-26 Modified 2024-09-05 Official page ↗
Aliases
CVE-2020-1932
Ecosystem
PyPI
Packages
apache-superset
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200
Reviewed
2020-02-25

Affected packages

• PyPI apache-superset: >= 0.34.0, < 0.35.2 → fixed in 0.35.2

Description

An information disclosure issue was found in Apache Superset 0.34.0, 0.34.1, 0.35.0, and 0.35.1. Authenticated Apache Superset users are able to retrieve other users' information, including hashed passwords, by accessing an unused and undocumented API endpoint on Apache Superset.

Related

Alias · CVE (1)

  • CVE-2020-1932 An information disclosure issue was found in Apache Superset 0.34.0, 0.34.1, 0.35.0, and 0.35.1. vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References