PT-2023-14667 · Apache · Apache Superset

Sunny Alexli · Published 2023-01-16 · Updated 2025-04-07 · CVE-2022-45438

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Superset versions 1.5.2 and prior Apache Superset version 2.0.0

Description The system allowed an unauthenticated user to access dashboard configuration metadata using a REST API Get endpoint when the feature flag DASHBOARD CACHE was explicitly enabled. This flag is disabled by default.

Recommendations For Apache Superset versions 1.5.2 and prior, consider disabling the DASHBOARD CACHE feature flag until a patch is available. For Apache Superset version 2.0.0, consider disabling the DASHBOARD CACHE feature flag until a patch is available. As a temporary workaround, restrict access to the REST API Get endpoint to minimize the risk of exploitation.

Fix

Improper Access Control

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-284

CWE-668

Related Identifiers

BIT-SUPERSET-2022-45438

CVE-2022-45438

GHSA-8F5J-MGX9-5HM5

Affected Products

Apache Superset

References · 9

• https://lists.apache.org/thread/snxbkf2x9kww7s0wkmydct9nhqqn9rv9 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-superset-2022-45438 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8f5j-mgx9-5hm5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-45438 · Security Note
• https://osv.dev/vulnerability/CVE-2022-45438 · Vendor Advisory
• https://github.com/apache/superset · Note
• https://t.me/cvenotify/42077 · Telegram Post
• https://t.me/cvenotify/118028 · Telegram Post
• https://t.me/cvenotify/42732 · Telegram Post