PT-2023-14667 · Apache · Apache Superset

Sunny Alexli · Publicado 2023-01-16 · Atualizado 2025-04-07 · CVE-2022-45438

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Superset versions 1.5.2 and prior Apache Superset version 2.0.0

Description The system allowed an unauthenticated user to access dashboard configuration metadata using a REST API Get endpoint when the feature flag DASHBOARD CACHE was explicitly enabled. This flag is disabled by default.

Recommendations For Apache Superset versions 1.5.2 and prior, consider disabling the DASHBOARD CACHE feature flag until a patch is available. For Apache Superset version 2.0.0, consider disabling the DASHBOARD CACHE feature flag until a patch is available. As a temporary workaround, restrict access to the REST API Get endpoint to minimize the risk of exploitation.

Correção

Improper Access Control

Exposure of Resource to Wrong Sphere

Enumeração de Fraquezas

CWE-284

CWE-668

Identificadores relacionados

BIT-SUPERSET-2022-45438

CVE-2022-45438

GHSA-8F5J-MGX9-5HM5

Produtos afetados

Apache Superset

Referências · 9

• https://github.com/apache/superset · Nota
• https://t.me/cvenotify/42077 · Publicação no Telegram
• https://lists.apache.org/thread/snxbkf2x9kww7s0wkmydct9nhqqn9rv9 · Aviso do Fabricante
• https://osv.dev/vulnerability/BIT-superset-2022-45438 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-8f5j-mgx9-5hm5 · Aviso do Fabricante
• https://t.me/cvenotify/118028 · Publicação no Telegram
• https://t.me/cvenotify/42732 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2022-45438 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2022-45438 · Aviso do Fabricante