PT-2023-31313 · Apache · Apache Superset

Jordan Velich · Published 2023-12-19 · Updated 2025-02-05 · CVE-2023-49734

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Superset versions prior to 2.1.3 Apache Superset versions 3.0.0 through 3.0.1

Description An authenticated Gamma user has the ability to create a dashboard and add charts to it, this user would automatically become one of the owners of the charts allowing him to incorrectly have write permissions to these charts. About 15,493 results are mainly distributed in the United States, China, and other countries.

Recommendations For Apache Superset versions prior to 2.1.3, upgrade to version 2.1.3. For Apache Superset versions 3.0.0 through 3.0.1, upgrade to version 3.0.2.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BIT-SUPERSET-2023-49734

CVE-2023-49734

GHSA-G49J-J489-3XPF

Affected Products

Apache Superset

References · 18

• https://nvd.nist.gov/vuln/detail/CVE-2023-49734 · Security Note
• https://osv.dev/vulnerability/BIT-superset-2023-49734 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-49734 · Vendor Advisory
• https://lists.apache.org/thread/985h6ltvtbvdoysso780kkj7x744cds5 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g49j-j489-3xpf · Vendor Advisory
• https://github.com/apache/superset · Note
• https://github.com/apache/superset/pull/25843 · Note
• https://github.com/apache/superset/commit/cb6de0a9c9f505ee3f26e79ca9bfa5f3901528a0 · Note
• https://github.com/apache/superset/commit/5198279a2ba41ab3e89bd9d7750694179d3f9fe6 · Note
• https://t.me/cvenotify/65472 · Telegram Post
• https://twitter.com/zoomeye_team/status/1737738972762411340 · Twitter Post
• https://twitter.com/CVEnew/status/1737054318451150973 · Twitter Post
• https://t.me/cvenotify/64155 · Telegram Post
• https://twitter.com/oss_security/status/1737113495471358332 · Twitter Post
• https://t.me/cvenotify/64110 · Telegram Post