Apache Superset: Possible Unauthorized Registration of SQLite Database Connections
CVE-2023-39265

3.8LOW

Key Information:

Vendor
Apache
Status
Apache Superset
Vendor
CVE Published:
6 September 2023

Summary

Apache Superset would allow for SQLite database connections to be incorrectly registered when an attacker uses alternative driver names like sqlite+pysqlite or by using database imports. This could allow for unexpected file creation on Superset webservers. Additionally, if Apache Superset is using a SQLite database for its metadata (not advised for production use) it could result in more severe vulnerabilities related to confidentiality and integrity. This vulnerability exists in Apache Superset versions up to and including 2.1.0.

Affected Version(s)

Apache Superset 0 <= 2.1.0

References

https://lists.apache.org/thread/pwdzsdmv4g5g1n2h9m7ortfnx...
vendor-advisory
http://packetstormsecurity.com/files/175094/Apache-Supers...

CVSS V3.1

Score:
3.8
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Naveen Sunkavally (Horizon3.ai)
.