PT-2024-21816 · Apache · Apache Superset

Anastasios Stasinopoulos · Published 2024-02-28 · Updated 2025-02-05 · CVE-2024-27315

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache Superset versions prior to 3.0.4 Apache Superset versions 3.1.0 through 3.1.1

Description An authenticated user with privileges to create alerts on Alerts & Reports can generate a specially crafted SQL statement that triggers an error on the database. This error is not properly handled by Apache Superset and may inadvertently surface in the error log of the Alert, exposing possibly sensitive data.

Recommendations For Apache Superset versions prior to 3.0.4, upgrade to version 3.0.4, which fixes the issue. For Apache Superset versions 3.1.0 through 3.1.1, upgrade to version 3.1.1, which fixes the issue.

Fix

Generation of Error Message Containing Sensitive Information

Information Disclosure

Weakness Enumeration

CWE-209

CWE-200

Related Identifiers

BIT-SUPERSET-2024-27315

CVE-2024-27315

GHSA-H7R6-8QMM-HJ5R

Affected Products

Apache Superset

References · 15

• https://nvd.nist.gov/vuln/detail/CVE-2024-27315 · Security Note
• https://osv.dev/vulnerability/GHSA-h7r6-8qmm-hj5r · Vendor Advisory
• https://lists.apache.org/thread/qcwbx7q2s3ynsd405895bx3wcwq32j7z · Vendor Advisory
• https://osv.dev/vulnerability/BIT-superset-2024-27315 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-27315 · Vendor Advisory
• https://github.com/apache/superset · Note
• https://twitter.com/oss_security/status/1762845719096901871 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1762803942541377965 · Twitter Post
• http://openwall.com/lists/oss-security/2024/02/28/3 · Note
• https://twitter.com/CVEnew/status/1762847258603602229 · Twitter Post
• https://twitter.com/dailycve/status/1874147992221241511 · Twitter Post
• https://t.me/cvenotify/105848 · Telegram Post
• https://t.me/cvenotify/72541 · Telegram Post
• https://twitter.com/ancst/status/1767990605232148869 · Twitter Post
• https://t.me/cvenotify/96915 · Telegram Post