CVE-2023-36388
published 2023-09-06CVE-2023-36388: Improper REST API permission in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma users to test network connections, possible SSRF.
PriorityP429medium5.4CVSS 3.1
AVNACLPRLUINSUCLILAN
EPSS
0.81%
52.5th percentile
Improper REST API permission in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma users to test network connections, possible SSRF.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | superset | <= 2.1.0 | — |
| apache_software_foundation | apache_superset | <= 2.1.0 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Apache Superset Server Side Request Forgery vulnerability
osv·2023-09-06
CVE-2023-36388 [MEDIUM] Apache Superset Server Side Request Forgery vulnerability
Apache Superset Server Side Request Forgery vulnerability
Improper REST API permission in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma users to test network connections, possible SSRF.
GHSA
Apache Superset Server Side Request Forgery vulnerability
ghsa·2023-09-06
CVE-2023-36388 [MEDIUM] CWE-918 Apache Superset Server Side Request Forgery vulnerability
Apache Superset Server Side Request Forgery vulnerability
Improper REST API permission in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma users to test network connections, possible SSRF.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-09-06
Published