PT-2019-12792 · Apache · Apache Incubator Superset

Published 2019-12-16 · Updated 2023-05-22 · CVE-2019-12413

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache Incubator Superset versions prior to 0.31

Description The issue allows a user to query database metadata information from a database they have no access to, by using a specially crafted complex query.

Recommendations For versions prior to 0.31, update to version 0.31 or later to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2019-12413

GHSA-P5W7-QMQ6-PMJR

PYSEC-2019-172

Affected Products

Apache Incubator Superset

References · 9

• https://lists.apache.org/thread.html/85ab04f8c52df8c353ecfa0ecd2ff27fc07fb8ab7566a754349806be%40%3Cdev.superset.apache.org%3E · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-12413 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12413 · Security Note
• https://osv.dev/vulnerability/GHSA-p5w7-qmq6-pmjr · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2019-172 · Vendor Advisory
• https://github.com/apache/superset · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-superset/PYSEC-2019-172.yaml · Note
• https://github.com/advisories/GHSA-p5w7-qmq6-pmjr · Note
• https://snyk.io/vuln/SNYK-PYTHON-APACHESUPERSET-558911 · Note