PT-2021-23459 · Apache · Apache Superset

Kevin Kusnardi · Published 2021-10-18 · Updated 2025-02-05 · CVE-2021-41971

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Superset versions up to and including 1.3.0

Description The issue allows SQL injection when a malicious authenticated user sends an HTTP request with a custom URL, but only when Apache Superset is configured with ENABLE TEMPLATE PROCESSING enabled, which is disabled by default.

Recommendations For Apache Superset versions up to and including 1.3.0, consider disabling the ENABLE TEMPLATE PROCESSING configuration to prevent SQL injection attacks until a patch is available.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BIT-SUPERSET-2021-41971

CVE-2021-41971

GHSA-PG8M-4P8J-2P56

PYSEC-2021-378

Affected Products

Apache Superset

References · 10

• https://osv.dev/vulnerability/BIT-superset-2021-41971 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-378 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41971 · Security Note
• https://lists.apache.org/thread.html/rf7292731268c6c6e2196ae1583e32ac7189385364268f8d9215e8e6d%40%3Cdev.superset.apache.org%3E · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-41971 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pg8m-4p8j-2p56 · Vendor Advisory
• https://github.com/apache/superset · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-superset/PYSEC-2021-378.yaml · Note
• https://t.me/cibsecurity/30715 · Telegram Post
• https://github.com/advisories/GHSA-pg8m-4p8j-2p56 · Note