Vulnerability · Published Feb 28, 2024 · Assigned by apache
CVE-2024-24773Apache Superset: Improper validation of SQL statements allows for unauthorized access to data
Medium 4.9
In plain English
A medium-severity incorrect authorization in Apache Superset from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Improper parsing of nested SQL statements on SQLLab would allow authenticated users to surpass their data authorization scope. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1, which fixes the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | apache-superset | 3.0.4 | GHSA-5474-f7g5-273q |
| PyPI | apache-superset | 3.1.1 | GHSA-5474-f7g5-273q |
| PyPI | apache-superset | 3.0.4, 3.1.1 | PYSEC-2026-1160 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Superset | 0 – before 3.0.43.1.0 – before 3.1.1 |
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N