Insecure Default Initialization of Resource Affecting apache-superset package, versions [,2.1.0)


0.0
high

Snyk CVSS

    Attack Complexity High
    Scope Changed
    Confidentiality High
    Integrity High

    Threat Intelligence

    Exploit Maturity Mature
    EPSS 97.3% (100th percentile)
Expand this section
NVD
9.8 critical

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-PYTHON-APACHESUPERSET-5458975
  • published 25 Apr 2023
  • disclosed 24 Apr 2023
  • credit Naveen Sunkavally

How to fix?

Upgrade apache-superset to version 2.1.0 or higher.

Overview

apache-superset is a modern, enterprise-ready business intelligence web application.

Affected versions of this package are vulnerable to Insecure Default Initialization of Resource due to the use of a default SECRET_KEY that could be abused by attackers to authenticate and access unauthorized resources on internet-exposed installations.

Impact: An attacker who has knowledge of the secret key can sign in to the vulnerable servers as an administrator by forging a session cookie and can seize control of the systems.

Note: This issue does not affect configurations in which the default value for SECRET_KEY config was changed.