WID-SEC-W-2024-0515

DeutschShown in its original language — a full translation is planned for a future version.

Apache Superset: Mehrere Schwachstellen ermöglichen Manipulation von Dateien

view advisory published 2024-02-28

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Apache Superset ausnutzen, um Dateien zu manipulieren.

describes (5)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2024-26016US	medium5.4OT elevated	0.87% (59th)	—	2024-02-28
A low privilege authenticated user could import an existing dashboard or chart that they do not have access to and then modify its metadata, thereby gaining ownership of the object…
CVE-2024-24779US	medium6.5OT elevated	0.73% (54th)	—	2024-02-28
Apache Superset with custom roles that include `can write on dataset` and without all data access permissions, allows for users to create virtual datasets to data they don't have a…
CVE-2024-24773US	medium6.5OT elevated	0.78% (56th)	—	2024-02-28
Improper parsing of nested SQL statements on SQLLab would allow authenticated users to surpass their data authorization scope. This issue affects Apache Superset: before 3.0.4, fro…
CVE-2024-24772US	medium4.3	0.95% (61st)	—	2024-02-28
A guest user could exploit a chart data REST API and send arbitrary SQL statements that on error could leak information from the underlying analytics database.This issue affects Ap…
CVE-2024-27315US	medium4.3	0.98% (62nd)	—	2024-02-28
An authenticated user with privileges to create Alerts on Alerts & Reports has the capability to generate a specially crafted SQL statement that triggers an error on the database.…

External citations — patches, advisories, analysis.

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.