PT-2024-20556 · Apache · Apache Superset

Dlt1412 · Published 2024-02-28 · Updated 2025-02-05 · CVE-2024-24779

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Superset versions prior to 3.0.4 Apache Superset versions 3.1.0 through 3.1.0

Description The issue allows users with custom roles that include can write on dataset and without all data access permissions to create virtual datasets to data they don't have access to. These users could then use those virtual datasets to get access to unauthorized data.

Recommendations For Apache Superset versions prior to 3.0.4, upgrade to version 3.0.4. For Apache Superset versions 3.1.0, upgrade to version 3.1.1.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BIT-SUPERSET-2024-24779

CVE-2024-24779

GHSA-WR6G-9WCR-CMQJ

Affected Products

Apache Superset

References · 11

• https://lists.apache.org/thread/xzhz1m5bb9zxhyqgoy4q2d689b3zp4pq · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wr6g-9wcr-cmqj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-24779 · Security Note
• https://osv.dev/vulnerability/CVE-2024-24779 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-superset-2024-24779 · Vendor Advisory
• https://github.com/apache/superset · Note
• https://t.me/cvenotify/72546 · Telegram Post
• https://twitter.com/CVEnew/status/1762847255659217232 · Twitter Post
• https://t.me/cvenotify/105851 · Telegram Post
• https://twitter.com/oss_security/status/1762845720996884931 · Twitter Post
• http://openwall.com/lists/oss-security/2024/02/28/6 · Note