PT-2024-21277 · Apache · Apache Superset

Matt Freyre · Published 2024-02-28 · Updated 2025-02-05 · CVE-2024-26016

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache Superset versions prior to 3.0.4 Apache Superset versions 3.1.0 through 3.1.0

Description A low privilege authenticated user could import an existing dashboard or chart that they do not have access to and then modify its metadata, thereby gaining ownership of the object. However, it's important to note that access to the analytical data of these charts and dashboards would still be subject to validation based on data access privileges.

Recommendations For Apache Superset versions prior to 3.0.4, upgrade to version 3.1.1. For Apache Superset versions 3.1.0, upgrade to version 3.1.1.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BIT-SUPERSET-2024-26016

CVE-2024-26016

GHSA-3V9R-885J-762G

Affected Products

Apache Superset

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2024-26016 · Security Note
• https://osv.dev/vulnerability/CVE-2024-26016 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3v9r-885j-762g · Vendor Advisory
• https://lists.apache.org/thread/76v1jjcylgk4p3m0258qr359ook3vl8s · Vendor Advisory
• https://osv.dev/vulnerability/BIT-superset-2024-26016 · Vendor Advisory
• https://github.com/apache/superset · Note
• https://t.me/cvenotify/72547 · Telegram Post
• https://twitter.com/CVEnew/status/1762847254426120245 · Twitter Post
• https://twitter.com/dailycve/status/1874148572985442453 · Twitter Post
• https://twitter.com/oss_security/status/1762845720996884931 · Twitter Post
• http://openwall.com/lists/oss-security/2024/02/28/7 · Note