BIT-superset-2020-1932

vendorUSosv

view advisory published 2025-02-05Licence: per source

An information disclosure issue was found in Apache Superset 0.34.0, 0.34.1, 0.35.0, and 0.35.1. Authenticated Apache Superset users are able to retrieve other users' information, including hashed passwords, by accessing an unused and undocumented API endpoint on Apache Superset.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2020-1932US	medium6.5	1.35% (71st)	—	2020-01-28
An information disclosure issue was found in Apache Superset 0.34.0, 0.34.1, 0.35.0, and 0.35.1. Authenticated Apache Superset users are able to retrieve other users' information,…

references

External citations — patches, advisories, analysis.

https://lists.apache.org/thread.html/r4e5323c3bc786005495311a6ff53ac6d990b2c7eb52941a1a13ce227%40%3Cdev.superset.apache.org%3EADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2020-1932WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan