CVE-2022-45438

CWE-668 — Exposure to Wrong SphereCWE-284 — Improper Access Control4 documents4 sources
Severity
5.3MEDIUM
EPSS
3.2%
top 12.89%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache Software Foundation Apache SupersetApache Superset
Timeline
PublishedJan 16

Description

When explicitly enabling the feature flag DASHBOARD_CACHE (disabled by default), the system allowed for an unauthenticated user to access dashboard configuration metadata using a REST API Get endpoint. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages3 packages

▶CVEListV5apache_software_foundation/apache_superset2.0.0 — 2.0.1+1
▶NVDapache/superset1.5.2+1
▶PyPIapache-superset1.5.2

🔴Vulnerability Details

3
OSV
Apache Superset has Improper Access Control↗2023-01-16
▶
CVEList
Apache Superset: Dashboard metadata information leak↗2023-01-16
▶
GHSA
Apache Superset has Improper Access Control↗2023-01-16
▶
CVE-2022-45438 (MEDIUM CVSS 5.3) | When explicitly enabling the featur | cvebase.io