CVE-2024-24773

published 2024-02-28

CVE-2024-24773: Improper parsing of nested SQL statements on SQLLab would allow authenticated users to surpass their data authorization scope. This issue affects Apache…

medium 6.5 CVSS 3.1

AV N AC L PR L UI N S U C H I N A N

Improper parsing of nested SQL statements on SQLLab would allow authenticated users to surpass their data authorization scope.
This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1.

Users are recommended to upgrade to version 3.1.1, which fixes the issue.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
apache	superset	< 3.0.4	3.0.4
apache	superset	>= 3.1.0 < 3.1.1	3.1.1
apache_software_foundation	apache_superset	< 3.0.4	3.0.4
apache_software_foundation	apache_superset	>= 3.1.0 < 3.1.1	3.1.1

CWE-863