BIT-superset-2023-36387

vendorUSosv

Apache Superset: Improper API permission for low privilege users

view advisory published 2025-02-05Licence: per source

An improper default REST API permission for Gamma users in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma user to test database connections.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-36387US	medium5.4OT elevated	1.13% (66th)	—	2023-09-06
An improper default REST API permission for Gamma users in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma user to test database connections.

references

External citations — patches, advisories, analysis.

https://github.com/apache/superset/pull/24185FIX
https://lists.apache.org/thread/tt6s6hm8nv6s11z8bfsk3r3d9ov0ogw3DISCUSSION
https://nvd.nist.gov/vuln/detail/CVE-2023-36387WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan