Dropdown Access Misconfiguration in Apache Incubator Superset

CVE-2019-12414

What is CVE-2019-12414?

In early versions of Apache Incubator Superset, specifically before 0.32, a security flaw allows unauthorized users to view database names in a dropdown list within SQLLab. This could lead to potential information disclosure, as sensitive database names may be visible to users who do not have the requisite permissions to access the corresponding databases. Proper user authentication and access control measures should be implemented to mitigate this exposure.

References