CVE-2023-39264
published 2023-09-06CVE-2023-39264: By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vulnerability exists…
PriorityP421medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.81%
52.7th percentile
By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vulnerability exists in Apache Superset versions up to and including 2.1.0.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | superset | <= 2.1.0 | — |
| apache_software_foundation | apache_superset | <= 2.1.0 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Apache Superset may expose internal traces on REST API endpoints
ghsa·2023-09-06
CVE-2023-39264 [MEDIUM] CWE-209 Apache Superset may expose internal traces on REST API endpoints
Apache Superset may expose internal traces on REST API endpoints
By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vulnerability exists in Apache Superset versions up to and including 2.1.0.
OSV
Apache Superset may expose internal traces on REST API endpoints
osv·2023-09-06
CVE-2023-39264 [MEDIUM] Apache Superset may expose internal traces on REST API endpoints
Apache Superset may expose internal traces on REST API endpoints
By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vulnerability exists in Apache Superset versions up to and including 2.1.0.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-09-06
Published