CVE-2023-25504CWE-918

Apache Superset: Possible SSRF on import datasets

Medium · published April 17, 2023

CVSS v3.1
4.9
EPSS
1%
Percentile
61.1
In the wild
Unconfirmed
What it is

A malicious actor who has been authenticated and granted specific permissions in Apache Superset may use the import dataset feature in order to conduct Server-Side Request Forgery

attacks and query internal resources on behalf of the server where Superset

is deployed. This vulnerability exists in Apache Superset versions up to and including 2.0.1.

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00957 · 61.1th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2023-04-17T16:29Z
EPSS history
Timeline
  • 17 APR 16:29Z
    Apache Superset: Possible SSRF on import datasets
    cvelistv5