Page 2 of 9 results (0.007 seconds)

CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0

A guest user could exploit a chart data REST API and send arbitrary SQL statements that on error could leak information from the underlying analytics database.This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue. • http://www.openwall.com/lists/oss-security/2024/02/28/5 https://lists.apache.org/thread/gfl3ckwy6y9tpz9jmpv62orh2q346sn5 • CWE-20: Improper Input Validation •

CVSS: 4.9EPSS: 0%CPEs: 2EXPL: 0

Improper parsing of nested SQL statements on SQLLab would allow authenticated users to surpass their data authorization scope. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1, which fixes the issue. • http://www.openwall.com/lists/oss-security/2024/02/28/4 https://lists.apache.org/thread/h66fy6nj41cfx07zh7l552w6dmtjh501 • CWE-863: Incorrect Authorization •

CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0

An authenticated user with privileges to create Alerts on Alerts & Reports has the capability to generate a specially crafted SQL statement that triggers an error on the database. This error is not properly handled by Apache Superset and may inadvertently surface in the error log of the Alert exposing possibly sensitive data. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue. An authenticated user with privileges to create Alerts on Alerts & Reports has the capability to generate a specially crafted SQL statement that triggers an error on the database. This error is not properly handled by Apache Superset and may inadvertently surface in the error log of the Alert exposing possibly sensitive data. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue. • http://www.openwall.com/lists/oss-security/2024/02/28/3 https://lists.apache.org/thread/qcwbx7q2s3ynsd405895bx3wcwq32j7z • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-209: Generation of Error Message Containing Sensitive Information •

CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0

This is a duplicate for CVE-2023-46104. With correct CVE version ranges for affected Apache Superset. Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets.   This vulnerability exists in Apache Superset versions up to and including 2.1.2 and versions 3.0.0, 3.0.1. Este es un duplicado de CVE-2023-46104. Con rangos de versión CVE correctos para Apache Superset afectado. • http://www.openwall.com/lists/oss-security/2024/02/14/2 http://www.openwall.com/lists/oss-security/2024/02/14/3 https://lists.apache.org/thread/zc58zvm4414molqn2m4d4vkrbrsxdksx • CWE-400: Uncontrolled Resource Consumption •