BIT-superset-2021-37839

vendorUSosv

Improper access to dataset metadata information

view advisory published 2025-02-05Licence: per source

Apache Superset up to 1.5.1 allowed for authenticated users to access metadata information related to datasets they have no permission on. This metadata included the dataset name, columns and metrics.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-37839US	medium4.3	1.37% (72nd)	—	2022-07-06
Apache Superset up to 1.5.1 allowed for authenticated users to access metadata information related to datasets they have no permission on. This metadata included the dataset name,…

references

External citations — patches, advisories, analysis.

https://lists.apache.org/thread/pwqyxxmn5gh7cnw3qsp66v0lt4xojt82ADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2021-37839WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan