PT-2023-28378 · Apache · Apache Superset

Amit Laish · CVE-2023-42504 · Published 2023-11-28 · Updated 2026-07-07

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache Superset versions prior to 3.0.0

Description The issue allows an authenticated malicious user to initiate multiple concurrent requests, each requesting multiple dashboard exports. This could lead to a possible denial of service.

Recommendations For versions prior to 3.0.0, update to version 3.0.0 or later to resolve the issue.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BIT-SUPERSET-2023-42504

CVE-2023-42504

GHSA-3HP7-4QQ4-V5C6

PYSEC-2026-1157

Affected Products

Apache Superset

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/42xxx/CVE-2023-42504.json · Exploit
• https://osv.dev/vulnerability/GHSA-3hp7-4qq4-v5c6 · Vendor Advisory
• https://lists.apache.org/thread/yzq5gk1y9lyw6nxwd3xdkxg1djqw1h6l · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-42504 · Security Note
• https://osv.dev/vulnerability/CVE-2023-42504 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-1157 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-superset-2023-42504 · Vendor Advisory
• https://github.com/apache/superset · Note
• https://github.com/advisories/GHSA-3hp7-4qq4-v5c6 · Note
• https://pypi.org/project/apache-superset · Note
• http://openwall.com/lists/oss-security/2023/11/28/6 · Note