PT-2023-5197 · Apache · Apache Superset

Jingjing Hu · Publicado 2023-09-06 · Atualizado 2025-02-05 · CVE-2023-27523

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Superset versions up to and including 2.1.0

Description The issue is related to improper data authorization checks on Jinja templated queries, allowing an authenticated user to issue queries on database tables they may not have access to. This can potentially enable a remote attacker to gain read access to the database.

Recommendations For Apache Superset versions up to and including 2.1.0, update to a version later than 2.1.0 to resolve the issue. At the moment, there is no information about other specific mitigation measures for this vulnerability.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

BDU:2023-05801

BIT-SUPERSET-2023-27523

CVE-2023-27523

GHSA-V594-2C97-HX38

Produtos afetados

Apache Superset

Referências · 11

• https://github.com/apache/superset · Nota
• https://lists.apache.org/thread/3y97nmwm956b6zg3l8dh9oj0w7dj945h · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1699436482300146017 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-27523 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-27523 · Nota de Segurança
• https://t.me/cvenotify/57945 · Publicação no Telegram
• https://osv.dev/vulnerability/BIT-superset-2023-27523 · Aviso do Fabricante
• https://twitter.com/oss_security/status/1699381453124190624 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-v594-2c97-hx38 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-05801 · Nota de Segurança
• https://twitter.com/CVEnew/status/1699416739799585013 · Publicação no Twitter