Improper Authorization Affecting apache-superset package, versions [,4.1.0rc2)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-APACHESUPERSET-8501337
- published13 Dec 2024
- disclosed12 Dec 2024
- creditJames Ford
Introduced: 12 Dec 2024
NewCVE-2024-55633 (opens in a new tab)Common Vulnerabilities and Exposures (CVE) are common identifiers for publicly known security vulnerabilities
Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade apache-superset to version 4.1.0rc2 or higher.
Overview
apache-superset is a modern, enterprise-ready business intelligence web application.
Affected versions of this package are vulnerable to Improper Authorization through the SQLLab component. An attacker can execute unauthorized write operations by crafting a specially designed SQL DML statement that is incorrectly identified as a read-only query.
Note:
This is only exploitable if the database connection is not set with a readonly user.