BIT-superset-2023-36387

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/superset/BIT-superset-2023-36387.json

JSON Data

https://api.osv.dev/v1/vulns/BIT-superset-2023-36387

Aliases

Published

2025-02-05T07:28:04.907Z

Modified

2025-05-20T10:02:07.006Z

Summary

Apache Superset: Improper API permission for low privilege users

Details

An improper default REST API permission for Gamma users in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma user to test database connections.

Database specific

{
    "cpes": [
        "cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:*"
    ],
    "severity": "Medium"
}

References

Affected packages

Bitnami / superset

Package

Name: superset
Purl: pkg:bitnami/superset

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.1.1

Database specific

source

"https://github.com/bitnami/vulndb/tree/main/data/superset/BIT-superset-2023-36387.json"