PT-2023-31313 · Apache · Apache Superset

Jordan Velich · Publicado 2023-12-19 · Atualizado 2025-02-05 · CVE-2023-49734

Positive Technologies (AI Summary)

CVSS v3.1

7.7

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Superset versions prior to 2.1.3 Apache Superset versions 3.0.0 through 3.0.1

Description An authenticated Gamma user has the ability to create a dashboard and add charts to it, this user would automatically become one of the owners of the charts allowing him to incorrectly have write permissions to these charts. About 15,493 results are mainly distributed in the United States, China, and other countries.

Recommendations For Apache Superset versions prior to 2.1.3, upgrade to version 2.1.3. For Apache Superset versions 3.0.0 through 3.0.1, upgrade to version 3.0.2.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

BIT-SUPERSET-2023-49734

CVE-2023-49734

GHSA-G49J-J489-3XPF

Produtos afetados

Apache Superset

Referências · 18

• https://github.com/apache/superset · Nota
• https://github.com/apache/superset/pull/25843 · Nota
• https://github.com/apache/superset/commit/cb6de0a9c9f505ee3f26e79ca9bfa5f3901528a0 · Nota
• https://github.com/apache/superset/commit/5198279a2ba41ab3e89bd9d7750694179d3f9fe6 · Nota
• https://t.me/cvenotify/65472 · Publicação no Telegram
• https://twitter.com/zoomeye_team/status/1737738972762411340 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1737054318451150973 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-49734 · Nota de Segurança
• https://t.me/cvenotify/64155 · Publicação no Telegram
• https://osv.dev/vulnerability/BIT-superset-2023-49734 · Aviso do Fabricante
• https://twitter.com/oss_security/status/1737113495471358332 · Publicação no Twitter
• https://t.me/cvenotify/64110 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1737078999820411249 · Publicação no Twitter
• http://openwall.com/lists/oss-security/2023/12/19/3 · Nota
• https://osv.dev/vulnerability/CVE-2023-49734 · Aviso do Fabricante