PT-2023-28378 · Apache · Apache Superset

Amit Laish · Published 2023-11-28 · Updated 2025-02-05 · CVE-2023-42504

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache Superset versions prior to 3.0.0

Description The issue allows an authenticated malicious user to initiate multiple concurrent requests, each requesting multiple dashboard exports. This could lead to a possible denial of service.

Recommendations For versions prior to 3.0.0, update to version 3.0.0 or later to resolve the issue.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BIT-SUPERSET-2023-42504

CVE-2023-42504

GHSA-3HP7-4QQ4-V5C6

Affected Products

Apache Superset

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-42504 · Security Note
• https://osv.dev/vulnerability/BIT-superset-2023-42504 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3hp7-4qq4-v5c6 · Vendor Advisory
• https://lists.apache.org/thread/yzq5gk1y9lyw6nxwd3xdkxg1djqw1h6l · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-42504 · Vendor Advisory
• https://github.com/apache/superset · Note
• http://openwall.com/lists/oss-security/2023/11/28/6 · Note