Apache Superset allowed for database connections password leak for authenticated users
Apache Superset up to and including 1.3.1 allowed for database connections password leak for authenticated users. This information could be accessed in a non-trivial way.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2021-41972US | medium6.5 | — | ||
Apache Superset up to and including 1.3.1 allowed for database connections password leak for authenticated users. This information could be accessed in a non-trivial way. | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/advisories/GHSA-42q4-9xf9-f67xADVISORY
- https://github.com/apache/supersetWEB
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-superset/PYSEC-2021-434.yamlWEB
- https://lists.apache.org/thread/xpdl2r538o695o7r9gd9qrwqb17bdd3vWEB
- https://nvd.nist.gov/vuln/detail/CVE-2021-41972ADVISORY
- https://seclists.org/oss-sec/2021/q4/106WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan