CVE-2024-24773

CWE-863 — Incorrect Authorization4 documents4 sources

Severity

6.5MEDIUM

EPSS

0.1%

top 64.48%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Apache Software Foundation Apache Superset Apache Superset

Timeline

PublishedFeb 28

Description

Improper parsing of nested SQL statements on SQLLab would allow authenticated users to surpass their data authorization scope. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1, which fixes the issue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NExploitability: 1.2 | Impact: 3.6

Affected Packages3 packages

▶NVDapache/superset3.1.0 — 3.1.1+1

▶PyPIapache-superset3.1.0 — 3.1.1+1

▶CVEListV5apache_software_foundation/apache_superset3.1.0 — 3.1.1+1

🔴Vulnerability Details

OSV

Apache Superset: Improper validation of SQL statements allows for unauthorized access to data↗2024-02-28

▶

GHSA

Apache Superset: Improper validation of SQL statements allows for unauthorized access to data↗2024-02-28

▶

CVEList

Apache Superset: Improper validation of SQL statements allows for unauthorized access to data↗2024-02-28

▶