PT-2024-9969 · Apache · Apache Superset

Daniel Gaspar

+2

·

Published

2024-12-09

·

Updated

2025-04-14

·

CVE-2024-53947

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions: Apache Superset versions prior to 4.1.0
Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not checked, allowing attackers to bypass SQL authorization. The affected functions include query to xml and xmlschema, table to xml, and table to xml and xmlschema. This vulnerability may allow a remote attacker to execute arbitrary SQL code.
Recommendations: For versions prior to 4.1.0, upgrade to version 4.1.0 to fix the issue. Alternatively, add the Postgres functions query to xml and xmlschema, table to xml, and table to xml and xmlschema to the config set DISALLOWED SQL FUNCTIONS as a temporary workaround.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2025-00083
BIT-SUPERSET-2024-53947
CVE-2024-53947
GHSA-92QF-8GH3-GWCM

Affected Products

Apache Superset