Improper Authorization Vulnerability in Apache Superset
CVE-2024-53949

7.6HIGH

Key Information:

Vendor
Apache
Status
Apache Superset
Vendor
CVE Published:
9 December 2024

Summary

An improper authorization vulnerability exists in Apache Superset when the FAB_ADD_SECURITY_API feature is enabled. This issue allows users with lower privileges to access and utilize APIs meant for higher privilege roles. This vulnerability affects versions from 2.0.0 to just before 4.1.0. Users are advised to upgrade to version 4.1.0 to mitigate this security risk.

Affected Version(s)

Apache Superset 2.0.0 < 4.1.0

References

https://lists.apache.org/thread/d3scbwmfpzbpm6npnzdw5y4ow...
vendor-advisory

CVSS V4

Score:
7.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

.