PT-2023-31315 · Apache · Apache Superset

Jack Prince-Fulls · Published 2023-12-19 · Updated 2025-02-05 · CVE-2023-49736

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Superset versions prior to 2.1.2 Apache Superset versions 3.0.0 through 3.0.1

Description A where in JINJA macro allows users to specify a quote, which combined with a carefully crafted statement would allow for SQL injection in Apache Superset.

Recommendations For Apache Superset versions prior to 2.1.2, upgrade to version 2.1.2 or later. For Apache Superset versions 3.0.0 through 3.0.1, upgrade to version 3.0.2.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BIT-SUPERSET-2023-49736

CVE-2023-49736

GHSA-JFXJ-XF67-X723

Affected Products

Apache Superset

References · 17

• https://osv.dev/vulnerability/GHSA-jfxj-xf67-x723 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-49736 · Security Note
• https://lists.apache.org/thread/1kf481bgs3451qcz6hfhobs7xvhp8n1p · Vendor Advisory
• https://osv.dev/vulnerability/BIT-superset-2023-49736 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-49736 · Vendor Advisory
• https://github.com/apache/superset · Note
• https://github.com/apache/superset/commit/34101594e284ab3acce692f41aff7759ccb4bf1d · Note
• https://github.com/apache/superset/commit/1d403dab9822a8cee6108669c53e53fad881c751 · Note
• https://github.com/apache/superset/pull/25779 · Note
• https://twitter.com/VulmonFeeds/status/1737079252875375032 · Twitter Post
• https://twitter.com/oss_security/status/1737113495471358332 · Twitter Post
• https://t.me/cvenotify/64111 · Telegram Post
• https://twitter.com/RedPacketSec/status/1737413708987474011 · Twitter Post
• http://openwall.com/lists/oss-security/2023/12/19/2 · Note
• https://t.me/cvenotify/64156 · Telegram Post