CVE-2023-49734 — Incorrect Authorization in Software Foundation Apache Superset

CWE-863 — Incorrect Authorization4 documents4 sources
Severity
6.5MEDIUMNVD
CNA7.7
EPSS
0.1%
top 65.86%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache Software Foundation Apache SupersetApache Superset
Timeline
PublishedDec 19

Description

An authenticated Gamma user has the ability to create a dashboard and add charts to it, this user would automatically become one of the owners of the charts allowing him to incorrectly have write permissions to these charts.This issue affects Apache Superset: before 2.1.2, from 3.0.0 before 3.0.2. Users are recommended to upgrade to version 3.0.2 or 2.1.3, which fixes the issue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶NVDapache/superset3.0.0 — 3.0.2+1
▶CVEListV5apache_software_foundation/apache_superset3.0.0 — 3.0.2+1

🔴Vulnerability Details

3
OSV
Apache Superset incorrect write permissions vulnerability↗2023-12-19
▶
GHSA
Apache Superset incorrect write permissions vulnerability↗2023-12-19
▶
CVEList
Apache Superset: Privilege Escalation Vulnerability↗2023-12-19
▶
CVE-2023-49734 — Incorrect Authorization | cvebase