CVE-2023-49736: A where_in JINJA macro allows users to specify a quote, which combined with a carefully crafted statement would allow for SQL injection in Apache Superset.This…

PriorityP353high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EPSS

1.18%

64.1th percentile

A where_in JINJA macro allows users to specify a quote, which combined with a carefully crafted statement would allow for SQL injection in Apache Superset.This issue affects Apache Superset: before 2.1.2, from 3.0.0 before 3.0.2. Users are recommended to upgrade to version 3.0.2, which fixes the issue.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
apache	superset	< 2.1.2	2.1.2
apache	superset	>= 3.0.0 < 3.0.2	3.0.2
apache_software_foundation	apache_superset	< 2.1.2	2.1.2
apache_software_foundation	apache_superset	>= 3.0.0 < 3.0.2	3.0.2

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.