PT-2020-13798 · Apache · Apache Superset

Published 2020-09-17 · Updated 2025-02-05 · CVE-2020-13948

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Superset versions prior to 0.37.1

Description The issue allows an authenticated user to gain arbitrary access to Python's os package in the web application process. This enables the user to list and access files, environment variables, and process information. Furthermore, it is possible to set environment variables for the current process, create and update files in folders writable by the web process, and execute arbitrary programs accessible by the web process. All other operations available to the os package in Python are also accessible.

Recommendations For versions prior to 0.37.1, update to version 0.37.1 or later to resolve the issue. As a temporary workaround, consider restricting access to templated text fields in the product to minimize the risk of exploitation.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BIT-SUPERSET-2020-13948

CVE-2020-13948

GHSA-CJ7G-H7RF-H8J9

PYSEC-2020-222

Affected Products

Apache Superset

References · 13

• https://osv.dev/vulnerability/BIT-superset-2020-13948 · Vendor Advisory
• https://lists.apache.org/thread.html/rdeee068ac1e0c43bd5b69830240f30598df15a2ef9f7998c7b29131e%40%3Cdev.superset.apache.org%3E · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-13948 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-13948 · Security Note
• https://osv.dev/vulnerability/GHSA-cj7g-h7rf-h8j9 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2020-222 · Vendor Advisory
• https://github.com/apache/superset · Note
• https://github.com/apache/superset/pull/11617#issuecomment-726204489 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-superset/PYSEC-2020-222.yaml · Note
• https://lists.apache.org/thread.html/r0e35c7c5672a6146b962840be5c1a7b7461c05a71cd7ecc62774d155%40%3Cnotifications.superset.apache.org%3E · Note
• https://lists.apache.org/thread.html/r4fc7115f6e63ac255c48fc68c0da592df55fe4be47cae6378d39ac22%40%3Cnotifications.superset.apache.org%3E · Note
• https://lists.apache.org/thread.html/r4fc7115f6e63ac255c48fc68c0da592df55fe4be47cae6378d39ac22@%3Cnotifications.superset.apache.org%3E · Note
• https://lists.apache.org/thread.html/r0e35c7c5672a6146b962840be5c1a7b7461c05a71cd7ecc62774d155@%3Cnotifications.superset.apache.org%3E · Note