Incorrectly Identified SQL DML Statement Vulnerability Affects Apache Superset Before 4.1.0

CVE-2024-55633

Summary

An improper authorization vulnerability exists in Apache Superset, allowing an attacker with SQLLab access to execute specially crafted SQL DML statements, which are incorrectly identified as read-only queries on Postgres analytic databases. This flaw is not present in non-Postgres database connections or Postgres connections using a read-only user role. Users are urged to upgrade to version 4.1.0 to mitigate this security risk.

References