Vulnerability · Published Apr 13, 2022 · Assigned by apache
CVE-2022-27479SQL injection vulnerability in chart data API
Critical 9.8
In plain English
A critical-severity SQL injection in Apache Superset from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.9% (higher than 87% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)2.9%top 13.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Apache Superset before 1.4.2 is vulnerable to SQL injection in chart data requests. Users should update to 1.4.2 or higher which addresses this issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | apache-superset | 1.4.2 | GHSA-wh73-hpcg-v32j |
| PyPI | apache-superset | 1.4.2 | PYSEC-2022-188 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Superset | unspecified – before 1.4.2 |
Weakness: CWE-89
References
- https://lists.apache.org/thread/94th50j5d0y2fw7ysx0g7w3t6jk3z7q6 x_refsource_MISC
- https://lists.apache.org/thread/ztb9b6jd9rngoxwvq8r4fhpp401o613y x_refsource_MISC
- [oss-security] 20220413 CVE-2022-27479: Apache Superset: SQL injection vulnerability in chart data API mailing-list, x_refsource_MLIST