BIT-superset-2023-27523

vendorUSosv

Apache Superset: Improper data permission validation on Jinja templated queries

view advisory published 2025-02-05Licence: per source

Improper data authorization check on Jinja templated queries in Apache Superset up to and including 2.1.0 allows for an authenticated user to issue queries on database tables they may not have access to.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-27523US	medium4.3OT elevated	1.02% (63rd)	—	2023-09-06
Improper data authorization check on Jinja templated queries in Apache Superset up to and including 2.1.0 allows for an authenticated user to issue queries on database tables they…

references

External citations — patches, advisories, analysis.

https://lists.apache.org/thread/3y97nmwm956b6zg3l8dh9oj0w7dj945hDISCUSSION
https://nvd.nist.gov/vuln/detail/CVE-2023-27523WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan