SU
Product
Superset
On CISA KEVExploited in the wild
70
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 5High 7Medium 58Low 0
Watch
Add Superset to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-42505 | 4.3 | Nov 28 | An authenticated user with read permissions on database connections metadata could potentially access sensitive information such as the connection's username Affected: before 3.0.0 |
| CVE-2023-42501 | 4.3 | Nov 27 | Unnecessary read permissions within the Gamma role would allow authenticated users to read configured CSS templates and annotations Affected: before 2.1.1 |
| CVE-2023-32672 | 4.3 | Sep 6 | An Incorrect authorisation check in SQLLab in Apache Superset versions up to and including 2.1.0 Affected: through 2.1.0 |
| CVE-2023-39264 | 4.3 | Sep 6 | By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vulnerability exists in Apache Superset… Affected: through 2.1.0 |
| CVE-2023-27526 | 4.3 | Sep 6 | A non Admin authenticated user could incorrectly create resources using the import charts feature, on Apache Superset up to and including 2.1.0 Affected: through 2.1.0 |
| CVE-2023-27523 | 4.3 | Sep 6 | Improper data authorization check on Jinja templated queries in Apache Superset up to and including 2.1.0 allows for an authenticated user to issue queries on database tables they… Affected: through 2.1.0 |
| CVE-2023-27525 | 4.3 | Apr 17 | An authenticated user with Gamma role authorization could have access to metadata information using non trivial methods in Apache Superset up to and including 2.0.1 Affected: through 2.0.1 |
| CVE-2021-37839 | 4.3 | Jul 6 | Apache Superset up to 1.5.1 allowed for authenticated users to access metadata information related to datasets they have no permission on Affected: through 1.5.1 |