PT-2023-28378 · Apache · Apache Superset

Amit Laish · Publicado 2023-11-28 · Atualizado 2025-02-05 · CVE-2023-42504

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache Superset versions prior to 3.0.0

Description The issue allows an authenticated malicious user to initiate multiple concurrent requests, each requesting multiple dashboard exports. This could lead to a possible denial of service.

Recommendations For versions prior to 3.0.0, update to version 3.0.0 or later to resolve the issue.

Correção

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-770

Identificadores relacionados

BIT-SUPERSET-2023-42504

CVE-2023-42504

GHSA-3HP7-4QQ4-V5C6

Produtos afetados

Apache Superset

Referências · 7

• https://github.com/apache/superset · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-42504 · Nota de Segurança
• https://osv.dev/vulnerability/BIT-superset-2023-42504 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2023/11/28/6 · Nota
• https://osv.dev/vulnerability/GHSA-3hp7-4qq4-v5c6 · Aviso do Fabricante
• https://lists.apache.org/thread/yzq5gk1y9lyw6nxwd3xdkxg1djqw1h6l · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-42504 · Aviso do Fabricante