Improper Access Control Affecting apache-superset package, versions [,1.5.3) [2.0.0,2.0.1)


0.0
medium

Snyk CVSS

    Attack Complexity Low

    Threat Intelligence

    EPSS 0.27% (68th percentile)
Expand this section
NVD
5.3 medium

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-PYTHON-APACHESUPERSET-3244380
  • published 22 Jan 2023
  • disclosed 16 Jan 2023
  • credit Unknown

How to fix?

Upgrade apache-superset to version 1.5.3, 2.0.1 or higher.

Overview

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Improper Access Control which allows an unauthenticated user to access the dashboard configuration metadata using the REST API Get endpoint. Exploiting this vulnerability is only possible when enabling the feature flag DASHBOARD_CACHE.