CVE-2022-41703 — SQL Injection in Software Foundation Apache Superset

CWE-89 — SQL Injection4 documents4 sources
Severity
5.4MEDIUMNVD
EPSS
1.3%
top 20.23%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache Software Foundation Apache SupersetApache Superset
Timeline
PublishedJan 16

Description

A vulnerability in the SQL Alchemy connector of Apache Superset allows an authenticated user with read access to a specific database to add subqueries to the WHERE and HAVING fields referencing tables on the same database that the user should not have access to, despite the user having the feature flag "ALLOW_ADHOC_SUBQUERY" disabled (default value). This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.5

Affected Packages2 packages

▶CVEListV5apache_software_foundation/apache_superset2.0.0 — 2.0.1+1
▶NVDapache/superset1.5.2+1

🔴Vulnerability Details

3
CVEList
Apache Superset: SQL injection vulnerability in adhoc clauses↗2023-01-16
▶
GHSA
Apache Superset's SQL Alchemy connector vulnerable to SQL Injection↗2023-01-16
▶
OSV
Apache Superset's SQL Alchemy connector vulnerable to SQL Injection↗2023-01-16
▶
CVE-2022-41703 — SQL Injection | cvebase