GitHub Advisoryadvisory · PyPI

GHSA-h7r6-8qmm-hj5r Apache Superset: Improper error handling on alerts

MEDIUM Published 2024-02-28 Modified 2024-10-03 Official page ↗
Aliases
CVE-2024-27315
Ecosystem
PyPI
Packages
apache-superset
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200, CWE-209
Reviewed
2024-02-28

Affected packages

• PyPI apache-superset: < 3.0.4 → fixed in 3.0.4 • PyPI apache-superset: >= 3.1.0, < 3.1.1 → fixed in 3.1.1

Description

An authenticated user with privileges to create Alerts on Alerts & Reports has the capability to generate a specially crafted SQL statement that triggers an error on the database. This error is not properly handled by Apache Superset and may inadvertently surface in the error log of the Alert exposing possibly sensitive data. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue.

Related

Alias · CVE (1)

  • CVE-2024-27315 An authenticated user with privileges to create Alerts on Alerts & Reports has the capability to generate a specially crafted SQL statement… vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-209 Generation of Error Message Containing Sensitive Information weakness

References