PT-2022-2397 · Apache · Apache Superset

Ville Brofeldt · Published 2022-04-13 · Updated 2025-02-05 · CVE-2022-27479

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Superset versions prior to 1.4.2

Description The issue is related to a lack of validation of XML object sequences, which can be exploited by a remote attacker to conduct SQL injection attacks. This can occur in chart data requests. The estimated number of potentially affected devices is not specified.

Recommendations For versions prior to 1.4.2, update to version 1.4.2 or higher to address the issue. As a temporary workaround, consider restricting access to chart data requests until the update is applied.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2022-02767

BIT-SUPERSET-2022-27479

CVE-2022-27479

GHSA-WH73-HPCG-V32J

PYSEC-2022-188

Affected Products

Apache Superset

References · 15

• https://nvd.nist.gov/vuln/detail/CVE-2022-27479 · Security Note
• https://osv.dev/vulnerability/PYSEC-2022-188 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-27479 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02767 · Security Note
• https://osv.dev/vulnerability/BIT-superset-2022-27479 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wh73-hpcg-v32j · Vendor Advisory
• https://github.com/apache/superset · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-superset/PYSEC-2022-188.yaml · Note
• https://github.com/advisories/GHSA-wh73-hpcg-v32j · Note
• https://vuldb.com/ru/?id.197300 · Note
• https://lists.apache.org/thread/ztb9b6jd9rngoxwvq8r4fhpp401o613y · Note
• https://t.me/cvenotify/28885 · Telegram Post
• http://openwall.com/lists/oss-security/2022/04/13/3 · Note
• https://lists.apache.org/thread/94th50j5d0y2fw7ysx0g7w3t6jk3z7q6 · Note
• https://t.me/cvenotify/28892 · Telegram Post