Apache Superset: SQL Injection on where_in JINJA macro
CVE-2023-49736

8.8HIGH

Key Information:

Vendor
Apache
Status
Apache Superset
Vendor
CVE Published:
19 December 2023

Summary

A vulnerability exists in Apache Superset due to a faulty implementation of a where_in JINJA macro, allowing users to input a malicious quote. This flaw can lead to SQL injection attacks that may compromise the integrity of the database. To safeguard against this vulnerability, users are strongly advised to upgrade to version 3.0.2, where the issue has been effectively mitigated.

Affected Version(s)

Apache Superset 0 < 2.1.2

Apache Superset 3.0.0 < 3.0.2

References

https://lists.apache.org/thread/1kf481bgs3451qcz6hfhobs7x...
vendor-advisory
http://www.openwall.com/lists/oss-security/2023/12/19/2

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jack Prince-Fulls ( [email protected] )
.