BIT-superset-2023-27523

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/superset/BIT-superset-2023-27523.json

JSON Data

https://api.osv.dev/v1/vulns/BIT-superset-2023-27523

Aliases

Published

2025-02-05T07:28:36Z

Modified

2026-09-08T08:48:16Z

Summary

Apache Superset: Improper data permission validation on Jinja templated queries

Details

Improper data authorization check on Jinja templated queries in Apache Superset up to and including 2.1.0 allows for an authenticated user to issue queries on database tables they may not have access to.

Database specific

{
    "cpes":  [
        "cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:*"
    ],
    "severity":  "Medium"
}

References

Affected packages

Bitnami / superset

Package

Name: superset
Purl: pkg:bitnami/superset

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.1.1

Database specific

source

"https://github.com/bitnami/vulndb/tree/main/data/superset/BIT-superset-2023-27523.json"