PT-2023-28379 · Apache · Apache Superset

Leonel John Erik Angel Torres · Publicado 2023-11-28 · Atualizado 2025-02-05 · CVE-2023-42505

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Superset versions prior to 3.0.0

Description The issue allows an authenticated user with read permissions on database connections metadata to potentially access sensitive information, such as the connection's username.

Recommendations For versions prior to 3.0.0, update to version 3.0.0 or later to resolve the issue.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

BIT-SUPERSET-2023-42505

CVE-2023-42505

GHSA-FGPW-4W69-J256

Produtos afetados

Apache Superset

Referências · 7

• https://github.com/apache/superset · Nota
• https://lists.apache.org/thread/bd0fhtfzrtgo1q8x35tpm8ms144d1t2y · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2023/11/28/5 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-42505 · Nota de Segurança
• https://osv.dev/vulnerability/BIT-superset-2023-42505 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-fgpw-4w69-j256 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-42505 · Aviso do Fabricante