PT-2023-28378 · Apache · Apache Superset

Amit Laish · CVE-2023-42504 · Publicado 2023-11-28 · Atualizado 2026-07-07

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache Superset versions prior to 3.0.0

Description The issue allows an authenticated malicious user to initiate multiple concurrent requests, each requesting multiple dashboard exports. This could lead to a possible denial of service.

Recommendations For versions prior to 3.0.0, update to version 3.0.0 or later to resolve the issue.

Exploit

Correção

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-770

Identificadores relacionados

BIT-SUPERSET-2023-42504

CVE-2023-42504

GHSA-3HP7-4QQ4-V5C6

PYSEC-2026-1157

Produtos afetados

Apache Superset

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/42xxx/CVE-2023-42504.json · Exploit
• https://github.com/apache/superset · Nota
• https://osv.dev/vulnerability/GHSA-3hp7-4qq4-v5c6 · Aviso do Fabricante
• https://lists.apache.org/thread/yzq5gk1y9lyw6nxwd3xdkxg1djqw1h6l · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-42504 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-42504 · Aviso do Fabricante
• https://github.com/advisories/GHSA-3hp7-4qq4-v5c6 · Nota
• https://osv.dev/vulnerability/PYSEC-2026-1157 · Aviso do Fabricante
• https://osv.dev/vulnerability/BIT-superset-2023-42504 · Aviso do Fabricante
• https://pypi.org/project/apache-superset · Nota
• http://openwall.com/lists/oss-security/2023/11/28/6 · Nota