PT-2023-20117 · Apache · Apache Superset

Alexey Sabadash · Published 2023-04-17 · Updated 2025-02-05 · CVE-2023-25504

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Superset versions up to and including 2.0.1

Description A malicious actor who has been authenticated and granted specific permissions in Apache Superset may use the import dataset feature to conduct Server-Side Request Forgery attacks and query internal resources on behalf of the server where Superset is deployed.

Recommendations For Apache Superset versions up to and including 2.0.1, consider disabling the import dataset feature as a temporary workaround until a patch is available. Restrict access to internal resources to minimize the risk of exploitation.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BIT-SUPERSET-2023-25504

CVE-2023-25504

GHSA-FXJG-28FM-PFXH

Affected Products

Apache Superset

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2023-25504 · Security Note
• https://osv.dev/vulnerability/GHSA-fxjg-28fm-pfxh · Vendor Advisory
• https://lists.apache.org/thread/tdnzkocfsqg2sbbornnp9g492fn4zhtx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-25504 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-superset-2023-25504 · Vendor Advisory
• https://github.com/apache/superset · Note
• https://t.me/cvenotify/48437 · Telegram Post
• https://t.me/cibsecurity/62293 · Telegram Post
• http://openwall.com/lists/oss-security/2023/04/18/8 · Note