PT-2019-12793 · Apache · Apache Incubator Superset

Published 2019-12-16 · Updated 2023-05-22 · CVE-2019-12414

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache Incubator Superset versions prior to 0.32

Description A user can view database names that he has no access to on a dropdown list in SQLLab.

Recommendations For versions prior to 0.32, update to version 0.32 or later to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2019-12414

GHSA-9C29-9H4M-WG5P

PYSEC-2019-173

Affected Products

Apache Incubator Superset

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2019-12414 · Security Note
• https://osv.dev/vulnerability/PYSEC-2019-173 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9c29-9h4m-wg5p · Vendor Advisory
• https://lists.apache.org/thread.html/396034aabe08dd349ff44eb062c718aadcf1b4e86f6372c7d5e988c0%40%3Cdev.superset.apache.org%3E · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-12414 · Vendor Advisory
• https://github.com/apache/superset · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-superset/PYSEC-2019-173.yaml · Note
• https://github.com/advisories/GHSA-9c29-9h4m-wg5p · Note