Vulnerability · Published Sep 6, 2023 · Assigned by apache
CVE-2023-39264Apache Superset: Stack traces enabled by default
Medium 4.3
In plain English
A medium-severity security flaw in Apache Superset from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 67% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)1.1%top 33.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vulnerability exists in Apache Superset versions up to and including 2.1.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | apache-superset | no fix listed | GHSA-cpvx-2365-466c |
| PyPI | apache-superset | 2.1.1 | PYSEC-2026-1172 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Superset | 0 – through 2.1.0 |
Weakness: CWE-209 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
- https://lists.apache.org/thread/y65t1of7hb445n86o1vdzjct7rfwlx75 vendor-advisory