Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1nNDlqLWo0ODktM3hwZs4AA35g

Apache Superset incorrect write permissions vulnerability

An authenticated Gamma user has the ability to create a dashboard and add charts to it, this user would automatically become one of the owners of the charts allowing him to incorrectly have write permissions to these charts.This issue affects Apache Superset: before 2.1.3, from 3.0.0 before 3.0.2.

Users are recommended to upgrade to version 3.0.2 or 2.1.3, which fixes the issue.

Permalink: https://github.com/advisories/GHSA-g49j-j489-3xpf
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1nNDlqLWo0ODktM3hwZs4AA35g
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 1 year ago
Updated: about 1 year ago

CVSS Score: 7.7
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

EPSS Percentage: 0.00045
EPSS Percentile: 0.17588

Identifiers: GHSA-g49j-j489-3xpf, CVE-2023-49734
References:

• https://nvd.nist.gov/vuln/detail/CVE-2023-49734
• https://lists.apache.org/thread/985h6ltvtbvdoysso780kkj7x744cds5
• https://github.com/apache/superset/pull/25843
• https://github.com/apache/superset/commit/5198279a2ba41ab3e89bd9d7750694179d3f9fe6
• https://github.com/apache/superset/commit/cb6de0a9c9f505ee3f26e79ca9bfa5f3901528a0
• http://www.openwall.com/lists/oss-security/2023/12/19/3
• https://github.com/advisories/GHSA-g49j-j489-3xpf

Repository: https://github.com/apache/superset
Blast Radius: 10.3

Affected Packages