DeutschShown in its original language — a full translation is planned for a future version.
Apache Superset: Mehrere Schwachstellen
view advisory published 2025-08-14
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Apache Superset ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen und vertrauliche Informationen offenzulegen.
01
describes (4)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-55675US | medium6.5 | — | ||
Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about da… | ||||
| CVE-2025-55674US | medium6.5 | — | ||
A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circum… | ||||
| CVE-2025-55673US | medium4.3 | — | ||
When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying quer… | ||||
| CVE-2025-55672US | medium5.4 | — | ||
A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payl… | ||||
02
references
External citations — patches, advisories, analysis.
- GitHub Security Advisory GHSA-9g5x-mm39-wg9r vom 2025-08-14external
- GitHub Security Advisory GHSA-fj97-2v9x-w5m4 vom 2025-08-14external
- GitHub Security Advisory GHSA-fxgf-3xh6-m2pp vom 2025-08-14external
- GitHub Security Advisory GHSA-mhpq-m962-mg92 vom 2025-08-14external
- Mailing list OSS Security vom 2025-08-14external
- Mailing list OSS Security vom 2025-08-14external
- Mailing list OSS Security vom 2025-08-14external
- Mailing list OSS Security vom 2025-08-14external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan