CVE-2024-39887mediumCWE-89

CVE-2024-39887: falha de média gravidade em Apache Superset

Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Apache Superset+ Monitorar apache-superset

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Corrija em breve. Ela tem exploit funcional público.

ssvc Attendcvss 4.3epss 4.4%
An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. To mitigate this, a new configuration key named DISALLOWED_SQL_FUNCTIONS has been introduced. This key disallows the use of the following PostgreSQL functions: version, query_to_xml, inet_server_addr, and inet_client_addr. Additional functions can be added to this list for increased protection. This issue affects Apache Superset: before 4.0.2. Users are recommended to upgrade to version 4.0.2, which fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
Apache Software Foundation · Apache Superset
CVEs relacionadas — Apache Superset

No mesmo produto, das mais perigosas para as menos.

CVE-2023-27524HIGHApache Superset: Session validation vulnerability when using provided default SECRET_KEYEPSS 98.1%KEVCVE-2021-27907—Apache Superset stored XSS on Dashboard markdownEPSS 86.4%CVE-2023-39265LOWApache Superset: Possible Unauthorized Registration of SQLite Database ConnectionsEPSS 86.0%CVE-2021-28125—Apache Superset Open RedirectEPSS 64.0%CVE-2023-37941MEDIUMApache Superset: Metadata db write access can lead to remote code executionEPSS 35.5%CVE-2021-44451—API sensitive information leakEPSS 7.9%