GitHub Advisoryadvisory · PyPI

GHSA-jfxj-xf67-x723 Apache Superset SQL injection vulnerability

MEDIUM Published 2023-12-19 Modified 2025-02-13 Official page ↗
Aliases
CVE-2023-49736
Ecosystem
PyPI
Packages
apache-superset
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-89
Reviewed
2023-12-19

Affected packages

• PyPI apache-superset: < 2.1.3 → fixed in 2.1.3 • PyPI apache-superset: >= 3.0.0, < 3.0.2 → fixed in 3.0.2

Description

A where_in JINJA macro allows users to specify a quote, which combined with a carefully crafted statement would allow for SQL injection in Apache Superset.This issue affects Apache Superset: before 2.1.3, from 3.0.0 before 3.0.2. Users are recommended to upgrade to version 2.1.3 or 3.0.2, which fixes the issue.

Related

Alias · CVE (1)

  • CVE-2023-49736 A where_in JINJA macro allows users to specify a quote, which combined with a carefully crafted statement would allow for SQL injection in… vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References