CVE-2023-46104
mediumpriority · track · 27EPSS 0.017 · 77 %ileDEEUUSEPSS · scored 2026-10-27
Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets. This vulnerability exists in Apache Superset versions up to and including 2.1.2 and versions 3.0.0, 3.0.1.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (8)
Products and version ranges known to be affected.
advisories (4)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2023-3184Apache Superset: Mehrere SchwachstellenDeutsch2023-12-19csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Apache Superset ausnutzen, um einen Denial of Service zu verursachen, Sicherheitseinstellungen zu umgehen und einen SQL-Injection Angriff durchzuführen.
- GHSA-95mg-jgfx-54v9Apache Superset uncontrolled resource consumption2023-12-19ghsa · osvUS
Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets. This vulnerability exists in Apache Superset versions up to and including 2.1.2 and versions 3.0.0, 3.0.1.
- BIT-superset-2023-46104Apache Superset: Allows for uncontrolled resource consumption via a ZIP bomb2025-02-05vendor · osvUS
Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets. This vulnerability exists in Apache Superset versions up to and including 2.1.2 and versions 3.0.0, 3.0.1.
- PYSEC-2026-1167Apache Superset uncontrolled resource consumption2026-07-07vendor · osvUS
Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets. This vulnerability exists in Apache Superset versions up to and including 2.1.2 and versions 3.0.0, 3.0.1.
also known as (7)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (14)
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2023/12/19/1cnnvd
- http://www.openwall.com/lists/oss-security/2024/02/14/2cnnvd
- http://www.openwall.com/lists/oss-security/2024/02/14/3cnnvd
- https://cxsecurity.com/cveshow/CVE-2023-46104/cnnvd
- https://lists.apache.org/thread/yxbxg4wryb7cb7wyybk11l5nqy0rsrvlcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2023-46104cnnvd
- http://www.openwall.com/lists/oss-security/2023/12/19/1enisa_euvd
- http://www.openwall.com/lists/oss-security/2024/02/14/2enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan