CVE-2023-46104
published 2023-12-19CVE-2023-46104: Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets. This…
PriorityP335medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
1.65%
73.8th percentile
Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets.
This vulnerability exists in Apache Superset versions up to and including 2.1.2 and versions 3.0.0, 3.0.1.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | superset | < 2.1.3 | 2.1.3 |
| apache | superset | >= 3.0.0 < 3.0.1 | 3.0.1 |
| apache | superset | >= 3.0.0 < 3.0.2 | 3.0.2 |
| apache_software_foundation | apache_superset | < 2.1.3 | 2.1.3 |
| apache_software_foundation | apache_superset | >= 3.0.0 < 3.0.2 | 3.0.2 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
ghsa6.5MEDIUM
osv6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Duplicate Advisory: Apache Superset uncontrolled resource consumption
osv·2024-05-30·CVSS 6.5
CVE-2023-46104 [MEDIUM] Duplicate Advisory: Apache Superset uncontrolled resource consumption
Duplicate Advisory: Apache Superset uncontrolled resource consumption
## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of CVE-2023-46104. This link is maintained to preserve external references.
## Original Description
With correct CVE version ranges for affected Apache Superset.
Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets.
This vulnerability exists in Apache Superset versions up to and including 2.1.2 and versions 3.0.0, 3.0.1.
GHSA
Duplicate Advisory: Apache Superset uncontrolled resource consumption
ghsa·2024-05-30·CVSS 6.5
CVE-2024-23952 [MEDIUM] CWE-400 Duplicate Advisory: Apache Superset uncontrolled resource consumption
Duplicate Advisory: Apache Superset uncontrolled resource consumption
## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of CVE-2023-46104. This link is maintained to preserve external references.
## Original Description
With correct CVE version ranges for affected Apache Superset.
Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets.
This vulnerability exists in Apache Superset versions up to and including 2.1.2 and versions 3.0.0, 3.0.1.
GHSA
Apache Superset uncontrolled resource consumption
ghsa·2023-12-19
CVE-2023-46104 [MEDIUM] CWE-400 Apache Superset uncontrolled resource consumption
Apache Superset uncontrolled resource consumption
Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets.
This vulnerability exists in Apache Superset versions up to and including 2.1.2 and versions 3.0.0, 3.0.1.
OSV
Apache Superset uncontrolled resource consumption
osv·2023-12-19
CVE-2023-46104 [MEDIUM] Apache Superset uncontrolled resource consumption
Apache Superset uncontrolled resource consumption
Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets.
This vulnerability exists in Apache Superset versions up to and including 2.1.2 and versions 3.0.0, 3.0.1.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.openwall.com/lists/oss-security/2023/12/19/1http://www.openwall.com/lists/oss-security/2024/02/14/2http://www.openwall.com/lists/oss-security/2024/02/14/3https://lists.apache.org/thread/yxbxg4wryb7cb7wyybk11l5nqy0rsrvlhttp://www.openwall.com/lists/oss-security/2023/12/19/1http://www.openwall.com/lists/oss-security/2024/02/14/2http://www.openwall.com/lists/oss-security/2024/02/14/3https://lists.apache.org/thread/yxbxg4wryb7cb7wyybk11l5nqy0rsrvl
2023-12-19
Published