GitHub Advisoryadvisory · PyPI

GHSA-v594-2c97-hx38 Apache Superset vulnerable to improper data authorization

MEDIUM Published 2023-09-06 Modified 2023-09-07 Official page ↗
Aliases
CVE-2023-27523
Ecosystem
PyPI
Packages
apache-superset
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Weaknesses
CWE-863
Reviewed
2023-09-07

Affected packages

• PyPI apache-superset: <= 2.1.0 (no fix yet)

Description

Improper data authorization check on Jinja templated queries in Apache Superset up to and including 2.1.0 allows for an authenticated user to issue queries on database tables they may not have access to.

Related

Alias · CVE (1)

  • CVE-2023-27523 Improper data authorization check on Jinja templated queries in Apache Superset up to and including 2.1.0 allows for an authenticated user… vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References