Improper Access Control Affecting apache-superset package, versions [,1.5.3) [2.0.0,2.0.1)
Threat Intelligence
EPSS
0.14% (50th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-APACHESUPERSET-3244380
- published 22 Jan 2023
- disclosed 16 Jan 2023
- credit Unknown
Introduced: 16 Jan 2023
CVE-2022-45438 Open this link in a new tabHow to fix?
Upgrade apache-superset to version 1.5.3, 2.0.1 or higher.
Overview
apache-superset is a modern, enterprise-ready business intelligence web application.
Affected versions of this package are vulnerable to Improper Access Control which allows an unauthenticated user to access the dashboard configuration metadata using the REST API Get endpoint. Exploiting this vulnerability is only possible when enabling the feature flag DASHBOARD_CACHE.
References
CVSS Scores
version 3.1