CVE-2024-53949

CWE-863 — Incorrect Authorization CWE-2854 documents4 sources

Severity

7.6HIGH

EPSS

0.3%

top 43.65%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Apache Software Foundation Apache Superset Apache Superset

Timeline

PublishedDec 9

Description

Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default). Allows for lower privilege users to use this API. issue affects Apache Superset: from 2.0.0 before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Affected Packages3 packages

▶NVDapache/superset2.0.0 — 4.1.0

▶PyPIapache-superset2.0.0 — 4.1.0

▶CVEListV5apache_software_foundation/apache_superset2.0.0 — 4.1.0

🔴Vulnerability Details

GHSA

Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled↗2024-12-09

▶

OSV

Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled↗2024-12-09

▶

CVEList

Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled↗2024-12-09

▶