BIT-superset-2023-42505

vendorUSosv

Apache Superset: Sensitive information disclosure on db connection details

view advisory published 2025-02-05Licence: per source

An authenticated user with read permissions on database connections metadata could potentially access sensitive information such as the connection's username. This issue affects Apache Superset before 3.0.0.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-42505US	medium4.3	1.02% (63rd)	—	2023-11-28
An authenticated user with read permissions on database connections metadata could potentially access sensitive information such as the connection's username. This issue affects A…

references

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2023/11/28/5ADVISORY
https://lists.apache.org/thread/bd0fhtfzrtgo1q8x35tpm8ms144d1t2yADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2023-42505WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan