PT-2024-5103 · Apache · Apache Superset

Mike Yushkovskiy · Published 2024-07-16 · Updated 2025-07-21 · CVE-2024-39887

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Apache Superset versions prior to 4.0.2

Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. The vulnerability is associated with the version, query to xml, inet server addr, and inet client addr functions.

Recommendations: To mitigate this issue, upgrade to version 4.0.2, which fixes the issue. As a temporary workaround, consider introducing a new configuration key named DISALLOWED SQL FUNCTIONS to disallow the use of the following PostgreSQL functions: version, query to xml, inet server addr, and inet client addr. Additional functions can be added to this list for increased protection.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2024-05630

BIT-SUPERSET-2024-39887

CVE-2024-39887

GHSA-2Q6J-VPVR-6PVJ

Affected Products

Apache Superset

References · 15

• https://osv.dev/vulnerability/BIT-superset-2024-39887 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-39887 · Vendor Advisory
• https://lists.apache.org/thread/j55vm41jg3l0x6w49zrmvbf3k0ts5fqz · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-39887 · Security Note
• https://osv.dev/vulnerability/GHSA-2q6j-vpvr-6pvj · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-05630 · Security Note
• https://github.com/apache/superset · Note
• https://github.com/apache/superset/commit/56f0103b5771d477dd106272abbd8021c9ea7506 · Note
• https://t.me/cvedetector/12393 · Telegram Post
• https://t.me/csirt_italia/2588 · Telegram Post
• https://t.me/cvenotify/86334 · Telegram Post
• https://openwall.com/lists/oss-security/2024/07/16/5 · Note
• https://t.me/cvedetector/926 · Telegram Post
• http://openwall.com/lists/oss-security/2024/07/16/5 · Note
• https://vuldb.com/?id.271560 · Note