CVE-2024-23952
mediumpriority · track · 27EPSS 0.017 · 77 %ileDEEUUSEPSS · scored 2026-10-27
This is a duplicate for CVE-2023-46104. With correct CVE version ranges for affected Apache Superset. Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets. This vulnerability exists in Apache Superset versions up to and including 2.1.2 and versions 3.0.0, 3.0.1.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (8)
Products and version ranges known to be affected.
advisories (3)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2023-3184Apache Superset: Mehrere SchwachstellenDeutsch2023-12-19csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Apache Superset ausnutzen, um einen Denial of Service zu verursachen, Sicherheitseinstellungen zu umgehen und einen SQL-Injection Angriff durchzuführen.
- GHSA-v7q3-5rqm-x7m9Duplicate Advisory: Apache Superset uncontrolled resource consumption2024-05-30ghsa · osvUS
## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of CVE-2023-46104. This link is maintained to preserve external references. ## Original Description With correct CVE version ranges for affected Apache Superset. Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets. This vulnerability exists in Apache Superset versions up to and including 2.1.2 and versions 3.0.0, 3.0.1.
- BIT-superset-2024-23952Apache Superset: Allows for uncontrolled resource consumption via a ZIP bomb (version range fix for CVE-2023-46104)2025-02-05vendor · osvUS
This is a duplicate for CVE-2023-46104. With correct CVE version ranges for affected Apache Superset. Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets. This vulnerability exists in Apache Superset versions up to and including 2.1.2 and versions 3.0.0, 3.0.1.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (10)
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2024/02/14/2cnnvd
- http://www.openwall.com/lists/oss-security/2024/02/14/3cnnvd
- https://cxsecurity.com/cveshow/CVE-2024-23952/cnnvd
- https://lists.apache.org/thread/zc58zvm4414molqn2m4d4vkrbrsxdksxcnnvd
- http://www.openwall.com/lists/oss-security/2024/02/14/2enisa_euvd
- http://www.openwall.com/lists/oss-security/2024/02/14/3enisa_euvd
- https://lists.apache.org/thread/zc58zvm4414molqn2m4d4vkrbrsxdksxenisa_euvd
- http://www.openwall.com/lists/oss-security/2024/02/14/2Mailing ListThird Party Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan