PT-2023-20117 · Apache · Apache Superset

Alexey Sabadash · Publicado 2023-04-17 · Atualizado 2025-02-05 · CVE-2023-25504

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Superset versions up to and including 2.0.1

Description A malicious actor who has been authenticated and granted specific permissions in Apache Superset may use the import dataset feature to conduct Server-Side Request Forgery attacks and query internal resources on behalf of the server where Superset is deployed.

Recommendations For Apache Superset versions up to and including 2.0.1, consider disabling the import dataset feature as a temporary workaround until a patch is available. Restrict access to internal resources to minimize the risk of exploitation.

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

BIT-SUPERSET-2023-25504

CVE-2023-25504

GHSA-FXJG-28FM-PFXH

Produtos afetados

Apache Superset

Referências · 9

• https://github.com/apache/superset · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-25504 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-fxjg-28fm-pfxh · Aviso do Fabricante
• https://lists.apache.org/thread/tdnzkocfsqg2sbbornnp9g492fn4zhtx · Aviso do Fabricante
• https://t.me/cvenotify/48437 · Publicação no Telegram
• https://t.me/cibsecurity/62293 · Publicação no Telegram
• http://openwall.com/lists/oss-security/2023/04/18/8 · Nota
• https://osv.dev/vulnerability/CVE-2023-25504 · Aviso do Fabricante
• https://osv.dev/vulnerability/BIT-superset-2023-25504 · Aviso do Fabricante