CVE-2023-37941

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2023-37941

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-37941.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2023-37941

Aliases

Published

2023-09-06T13:06:20.879Z

Modified

2026-07-08T06:10:23.009565196Z

Severity

6.6 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Apache Superset: Metadata db write access can lead to remote code execution

Details

If an attacker gains write access to the Apache Superset metadata database, they could persist a specifically crafted Python object that may lead to remote code execution on Superset's web backend.

The Superset metadata db is an 'internal' component that is typically only accessible directly by the system administrator and the superset process itself. Gaining access to that database should be difficult and require significant privileges.

This vulnerability impacts Apache Superset versions 1.5.0 up to and including 2.1.0. Users are recommended to upgrade to version 2.1.1 or later.

Database specific

{
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "1.5.0"
                },
                {
                    "last_affected": "2.1.0"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37941.json",
    "cna_assigner": "apache",
    "cwe_ids": [
        "CWE-502"
    ]
}

References

Affected packages

Git / github.com/apache/superset

Affected ranges

Type

GIT

Repo

https://github.com/apache/superset

Events

Introduced

054e6b23348e4a26efbe50109def40e721e49a2c

Last affected

2817aebd69dc7d199ec45d973a2079f35e5658b6

Database specific

{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.5.0"
        },
        {
            "last_affected": "2.1.0"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-37941.json"