Vulnerability · Published Nov 27, 2023 · Assigned by apache
CVE-2023-40610Apache Superset: Privilege escalation with default examples database
Medium 6.3
In plain English
A medium-severity incorrect authorization in Apache Superset from Apache Software Foundation. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Improper authorization check and possible privilege escalation on Apache Superset up to but excluding 2.1.2. Using the default examples database connection that allows access to both the examples schema and Apache Superset's metadata database, an attacker using a specially crafted CTE SQL statement could change data on the metadata database. This weakness could result on tampering with the authentication/authorization data.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | apache-superset | 2.1.2 | GHSA-f678-j579-4xf5 |
| PyPI | apache-superset | 2.1.2 | PYSEC-2026-1173 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Superset | 0 – before 2.1.2 |
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N