CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2024-24772 – Apache Superset: Improper Neutralisation of custom SQL on embedded context
https://notcve.org/view.php?id=CVE-2024-24772
A guest user could exploit a chart data REST API and send arbitrary SQL statements that on error could leak information from the underlying analytics database.This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue. • http://www.openwall.com/lists/oss-security/2024/02/28/5 https://lists.apache.org/thread/gfl3ckwy6y9tpz9jmpv62orh2q346sn5 • CWE-20: Improper Input Validation •
CVSS: 4.9EPSS: 0%CPEs: 2EXPL: 0CVE-2024-24773 – Apache Superset: Improper validation of SQL statements allows for unauthorized access to data
https://notcve.org/view.php?id=CVE-2024-24773
Improper parsing of nested SQL statements on SQLLab would allow authenticated users to surpass their data authorization scope. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1, which fixes the issue. • http://www.openwall.com/lists/oss-security/2024/02/28/4 https://lists.apache.org/thread/h66fy6nj41cfx07zh7l552w6dmtjh501 • CWE-863: Incorrect Authorization •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2024-27315 – Apache Superset: Improper error handling on alerts
https://notcve.org/view.php?id=CVE-2024-27315
An authenticated user with privileges to create Alerts on Alerts & Reports has the capability to generate a specially crafted SQL statement that triggers an error on the database. This error is not properly handled by Apache Superset and may inadvertently surface in the error log of the Alert exposing possibly sensitive data. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue. An authenticated user with privileges to create Alerts on Alerts & Reports has the capability to generate a specially crafted SQL statement that triggers an error on the database. This error is not properly handled by Apache Superset and may inadvertently surface in the error log of the Alert exposing possibly sensitive data. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue. • http://www.openwall.com/lists/oss-security/2024/02/28/3 https://lists.apache.org/thread/qcwbx7q2s3ynsd405895bx3wcwq32j7z • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2024-23952 – Apache Superset: Allows for uncontrolled resource consumption via a ZIP bomb (version range fix for CVE-2023-46104)
https://notcve.org/view.php?id=CVE-2024-23952
This is a duplicate for CVE-2023-46104. With correct CVE version ranges for affected Apache Superset. Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets. This vulnerability exists in Apache Superset versions up to and including 2.1.2 and versions 3.0.0, 3.0.1. Este es un duplicado de CVE-2023-46104. Con rangos de versión CVE correctos para Apache Superset afectado. • http://www.openwall.com/lists/oss-security/2024/02/14/2 http://www.openwall.com/lists/oss-security/2024/02/14/3 https://lists.apache.org/thread/zc58zvm4414molqn2m4d4vkrbrsxdksx • CWE-400: Uncontrolled Resource Consumption •
CVSS: 9.6EPSS: 0%CPEs: 1EXPL: 0CVE-2023-49657 – Apache Superset: Stored XSS in Dashboard Title and Chart Title
https://notcve.org/view.php?id=CVE-2023-49657
A stored cross-site scripting (XSS) vulnerability exists in Apache Superset before 3.0.3. An authenticated attacker with create/update permissions on charts or dashboards could store a script or add a specific HTML snippet that would act as a stored XSS. For 2.X versions, users should change their config to include: TALISMAN_CONFIG = { "content_security_policy": { "base-uri": ["'self'"], "default-src": ["'self'"], "img-src": ["'self'", "blob:", "data:"], "worker-src": ["'self'", "blob:"], "connect-src": [ "'self'", " https://api.mapbox.com" https://api.mapbox.com" ;, " https://events.mapbox.com" https://events.mapbox.com" ;, ], "object-src": "'none'", "style-src": [ "'self'", "'unsafe-inline'", ], "script-src": ["'self'", "'strict-dynamic'"], }, "content_security_policy_nonce_in": ["script-src"], "force_https": False, "session_cookie_secure": False, } Existe una vulnerabilidad de cross-site scripting (XSS) almacenado en Apache Superset anterior a 3.0.3. Un atacante autenticado con permisos de creación/actualización en gráficos o paneles podría almacenar un script o agregar un fragmento HTML específico que actuaría como un XSS almacenado. Para las versiones 2.X, los usuarios deben cambiar su configuración para incluir: TALISMAN_CONFIG = { "content_security_policy": { "base-uri": ["'self'"], "default-src": ["'self'"], "img-src": ["'self'", "blob:", "data:"], "worker-src": ["'self'", "blob:"], "connect-src": [ "'self'", " https://api.mapbox.com" https://api.mapbox.com" ;, " https://events.mapbox.com" https://events.mapbox.com" ;, ], "object-src": "'none'", "style-src": [ "'self'", "'unsafe-inline'", ], "script-src": ["'self' ", "'strict-dynamic'"], }, "content_security_policy_nonce_in": ["script-src"], "force_https": False, "session_cookie_secure": False, } • https://lists.apache.org/thread/wjyvz8om9nwd396lh0bt156mtwjxpsvx • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •