BIT-superset-2022-27479

vendorUSosv

SQL injection vulnerability in chart data API

view advisory published 2025-02-05Licence: per source

Apache Superset before 1.4.2 is vulnerable to SQL injection in chart data requests. Users should update to 1.4.2 or higher which addresses this issue.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-27479US	critical9.8	2.90% (87th)	—	2022-04-13
Apache Superset before 1.4.2 is vulnerable to SQL injection in chart data requests. Users should update to 1.4.2 or higher which addresses this issue.

references

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2022/04/13/3ADVISORY
https://lists.apache.org/thread/94th50j5d0y2fw7ysx0g7w3t6jk3z7q6WEB
https://lists.apache.org/thread/ztb9b6jd9rngoxwvq8r4fhpp401o613yWEB
https://nvd.nist.gov/vuln/detail/CVE-2022-27479WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan