Apache Superset: Improper validation of SQL statements allows for unauthorized access to data
Improper parsing of nested SQL statements on SQLLab would allow authenticated users to surpass their data authorization scope. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1, which fixes the issue.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-24773US | medium6.5OT erhöht | — | ||
Improper parsing of nested SQL statements on SQLLab would allow authenticated users to surpass their data authorization scope.
This issue affects Apache Superset: before 3.0.4, fro… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://www.openwall.com/lists/oss-security/2024/02/28/4WEB
- https://github.com/advisories/GHSA-5474-f7g5-273qADVISORY
- https://github.com/apache/supersetPACKAGE
- https://lists.apache.org/thread/h66fy6nj41cfx07zh7l552w6dmtjh501WEB
- https://nvd.nist.gov/vuln/detail/CVE-2024-24773ADVISORY
- https://pypi.org/project/apache-supersetPACKAGE
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan