Vulnerability · Published Sep 6, 2023 · Assigned by apache
CVE-2023-39265Apache Superset: Possible Unauthorized Registration of SQLite Database Connections
Low 3.8
In plain English
A low-severity improper input validation in Apache Superset from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 86.0% (higher than 99.7% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit. Fixed versions are available - upgrade the affected package.
Official description
Apache Superset would allow for SQLite database connections to be incorrectly registered when an attacker uses alternative driver names like sqlite+pysqlite or by using database imports. This could allow for unexpected file creation on Superset webservers. Additionally, if Apache Superset is using a SQLite database for its metadata (not advised for production use) it could result in more severe vulnerabilities related to confidentiality and integrity. This vulnerability exists in Apache Superset versions up to and including 2.1.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | apache-superset | no fix listed | GHSA-fm4q-j8g4-c9j4 |
| PyPI | apache-superset | 2.1.1 | PYSEC-2026-1177 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Superset | 0 – through 2.1.0 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N