CVE-2023-32672CWE-863

Apache Superset: SQL parser edge case bypasses data access authorization

Medium · published September 6, 2023

CVSS v3.1
4.3
EPSS
1%
Percentile
63.6
In the wild
Unconfirmed
What it is

An Incorrect authorisation check in SQLLab in Apache Superset versions up to and including 2.1.0. This vulnerability allows an authenticated user to query tables that they do not have proper access to within Superset. The vulnerability can be exploited by leveraging a SQL parsing vulnerability.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01038 · 63.6th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2023-09-06T13:16Z
EPSS history
Timeline
  • 06 SEP 13:16Z
    Apache Superset: SQL parser edge case bypasses data access authorization
    cvelistv5