GHSA-fj4x-m62j-wvwg

Source

https://github.com/advisories/GHSA-fj4x-m62j-wvwg

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/09/GHSA-fj4x-m62j-wvwg/GHSA-fj4x-m62j-wvwg.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-fj4x-m62j-wvwg

Aliases

CVE-2023-37941

Published

2023-09-06T15:30:27Z

Modified

2023-11-08T05:20:45.728145Z

Severity

6.6 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Apache Superset Deserialization of Untrusted Data vulnerability

Details

If an attacker gains write access to the Apache Superset metadata database, they could persist a specifically crafted Python object that may lead to remote code execution on Superset's web backend. The Superset metadata db is an 'internal' component that is typically only accessible directly by the system administrator and the superset process itself. Gaining access to that database should be difficult and require significant privileges. This vulnerability impacts Apache Superset versions 1.5.0 up to and including 2.1.0. Users are recommended to upgrade to version 2.1.1 or later.

Database specific

{
    "nvd_published_at": "2023-09-06T14:15:10Z",
    "cwe_ids": [
        "CWE-502"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-09-08T12:18:53Z"
}

References

Affected packages

PyPI / apache-superset

Package

Name: apache-superset; View open source insights on deps.dev
Purl: pkg:pypi/apache-superset

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.5.0

Fixed

2.1.1

Affected versions

1.*

1.5.0

1.5.1

1.5.2

1.5.3

2.*

2.0.0

2.0.1

2.1.0

2.1.1rc1

2.1.1rc2

2.1.1rc3

Database specific

{
    "last_known_affected_version_range": "<= 2.1.0"
}