PT-2018-18386 · Apache+1 · Superset+1

David May · Publicado 2018-11-07 · Atualizado 2019-01-30 · CVE-2018-8021

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Superset versions prior to 0.23

Description: The issue is related to the use of an unsafe load method from the pickle library to deserialize data, which can lead to possible remote code execution.

Recommendations: For versions prior to 0.23, update to version 0.23 or later to resolve the issue.

Exploit

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

CVE-2018-8021

GHSA-VXP9-WV2F-WQMW

PYSEC-2018-74

Produtos afetados

Superset

Pickle

Referências · 12

• 🔥 https://github.com/r3dxpl0it/Apache-Superset-Remote-Code-Execution-PoC-CVE-2018-8021 · Exploit
• 🔥 https://exploit-db.com/exploits/45933 · Exploit
• https://github.com/apache/superset · Nota
• https://github.com/apache/superset/pull/4243 · Nota
• https://github.com/apache/incubator-superset/pull/4243 · Correção
• https://github.com/apache/superset/commit/2c72a7ae4fc0a8bac1f037a79efa90e1c5549710 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/superset/PYSEC-2018-74.yaml · Nota
• https://osv.dev/vulnerability/GHSA-vxp9-wv2f-wqmw · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-8021 · Nota de Segurança
• https://github.com/advisories/GHSA-vxp9-wv2f-wqmw · Nota
• https://osv.dev/vulnerability/PYSEC-2018-74 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-8021 · Aviso do Fabricante