PT-2023-5197 · Apache · Apache Superset

Jingjing Hu · Published 2023-09-06 · Updated 2025-02-05 · CVE-2023-27523

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Superset versions up to and including 2.1.0

Description The issue is related to improper data authorization checks on Jinja templated queries, allowing an authenticated user to issue queries on database tables they may not have access to. This can potentially enable a remote attacker to gain read access to the database.

Recommendations For Apache Superset versions up to and including 2.1.0, update to a version later than 2.1.0 to resolve the issue. At the moment, there is no information about other specific mitigation measures for this vulnerability.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2023-05801

BIT-SUPERSET-2023-27523

CVE-2023-27523

GHSA-V594-2C97-HX38

Affected Products

Apache Superset

References · 11

• https://lists.apache.org/thread/3y97nmwm956b6zg3l8dh9oj0w7dj945h · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-27523 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-27523 · Security Note
• https://osv.dev/vulnerability/BIT-superset-2023-27523 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v594-2c97-hx38 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05801 · Security Note
• https://github.com/apache/superset · Note
• https://twitter.com/VulmonFeeds/status/1699436482300146017 · Twitter Post
• https://t.me/cvenotify/57945 · Telegram Post
• https://twitter.com/oss_security/status/1699381453124190624 · Twitter Post
• https://twitter.com/CVEnew/status/1699416739799585013 · Twitter Post