CVE-2022-41703
published 2023-01-16CVE-2022-41703: A vulnerability in the SQL Alchemy connector of Apache Superset allows an authenticated user with read access to a specific database to add subqueries to the…
PriorityP431medium5.4CVSS 3.1
AVNACLPRLUINSUCLILAN
EPSS
1.19%
64.4th percentile
A vulnerability in the SQL Alchemy connector of Apache Superset allows an authenticated user with read access to a specific database to add subqueries to the WHERE and HAVING fields referencing tables on the same database that the user should not have access to, despite the user having the feature flag "ALLOW_ADHOC_SUBQUERY" disabled (default value). This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | superset | <= 1.5.2 | — |
| apache | superset | — | — |
| apache_software_foundation | apache_superset | <= 1.5.2 | — |
| apache_software_foundation | apache_superset | >= 2.0.0 < 2.0.1 | 2.0.1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Apache Superset's SQL Alchemy connector vulnerable to SQL Injection
ghsa·2023-01-16
CVE-2022-41703 [MEDIUM] CWE-89 Apache Superset's SQL Alchemy connector vulnerable to SQL Injection
Apache Superset's SQL Alchemy connector vulnerable to SQL Injection
A vulnerability in the SQL Alchemy connector of Apache Superset allows an authenticated user with read access to a specific database to add subqueries to the WHERE and HAVING fields referencing tables on the same database that the user should not have access to, despite the user having the feature flag "ALLOW_ADHOC_SUBQUERY" disabled (default value). This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.
OSV
Apache Superset's SQL Alchemy connector vulnerable to SQL Injection
osv·2023-01-16
CVE-2022-41703 [MEDIUM] Apache Superset's SQL Alchemy connector vulnerable to SQL Injection
Apache Superset's SQL Alchemy connector vulnerable to SQL Injection
A vulnerability in the SQL Alchemy connector of Apache Superset allows an authenticated user with read access to a specific database to add subqueries to the WHERE and HAVING fields referencing tables on the same database that the user should not have access to, despite the user having the feature flag "ALLOW_ADHOC_SUBQUERY" disabled (default value). This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-01-16
Published