PT-2022-12120 · Apache · Apache Superset

Cesar Santos · Published 2022-02-01 · Updated 2025-02-05 · CVE-2021-44451

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache Superset versions up to and including 1.3.2

Description The issue allows for the leak of registered database connections passwords to authenticated users. This information can be accessed in a non-trivial way.

Recommendations For Apache Superset versions up to and including 1.3.2, upgrade to Apache Superset 1.4.0 or higher.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

BIT-SUPERSET-2021-44451

CVE-2021-44451

GHSA-HHM3-48H2-597V

PYSEC-2022-36

Affected Products

Apache Superset

References · 9

• https://lists.apache.org/thread/xww1pccs2ckb5506wrf1v4lmxg198vkb · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-44451 · Security Note
• https://osv.dev/vulnerability/BIT-superset-2021-44451 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hhm3-48h2-597v · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-44451 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-36 · Vendor Advisory
• https://github.com/apache/superset · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-superset/PYSEC-2022-36.yaml · Note
• https://github.com/advisories/GHSA-hhm3-48h2-597v · Note