CVE-2024-28148

published 2024-05-07

CVE-2024-28148: An authenticated user could potentially access metadata for a datasource they are not authorized to view by submitting a targeted REST API request.This issue…

medium 4.3 CVSS 3.1

AV N AC L PR L UI N S U C L I N A N

An authenticated user could potentially access metadata for a datasource they are not authorized to view by submitting a targeted REST API request.This issue affects Apache Superset: before 3.1.2.

Users are recommended to upgrade to version 3.1.2 or above, which fixes the issue.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
apache	superset	< 4.0.0	4.0.0
apache_software_foundation	apache_superset	< 3.1.2	3.1.2

CWE-863