CVE-2024-24772

CWE-89 — SQL InjectionCWE-20 — Improper Input Validation4 documents4 sources
Severity
4.3MEDIUM
EPSS
0.6%
top 31.25%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache Software Foundation Apache SupersetApache Superset
Timeline
PublishedFeb 28

Description

A guest user could exploit a chart data REST API and send arbitrary SQL statements that on error could leak information from the underlying analytics database.This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages3 packages

▶NVDapache/superset3.1.0 — 3.1.1+1
▶PyPIapache-superset3.1.0 — 3.1.1+1
▶CVEListV5apache_software_foundation/apache_superset3.1.0 — 3.1.1+1

🔴Vulnerability Details

3
CVEList
Apache Superset: Improper Neutralisation of custom SQL on embedded context↗2024-02-28
▶
GHSA
Apache Superset: Improper Neutralization of custom SQL on embedded context↗2024-02-28
▶
OSV
Apache Superset: Improper Neutralization of custom SQL on embedded context↗2024-02-28
▶
CVE-2024-24772 (MEDIUM CVSS 4.3) | A guest user could exploit a chart | cvebase.io