BIT-superset-2023-32672

vendorUSosv

Apache Superset: SQL parser edge case bypasses data access authorization

view advisory published 2025-02-05Licence: per source

An Incorrect authorisation check in SQLLab in Apache Superset versions up to and including 2.1.0. This vulnerability allows an authenticated user to query tables that they do not have proper access to within Superset. The vulnerability can be exploited by leveraging a SQL parsing vulnerability.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-32672US	medium4.3OT elevated	1.04% (64th)	—	2023-09-06
An Incorrect authorisation check in SQLLab in Apache Superset versions up to and including 2.1.0. This vulnerability allows an authenticated user to query tables that they do not h…

references

External citations — patches, advisories, analysis.

https://lists.apache.org/thread/ococ6nlj80f0okkwfwpjczy3q84j3wkpADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2023-32672WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan