CVE-2023-36387CWE-863

Apache Superset: Improper API permission for low privilege users

Medium · published September 6, 2023

CVSS v3.1
5.4
EPSS
1%
Percentile
66.2
In the wild
Unconfirmed
What it is

An improper default REST API permission for Gamma users in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma user to test database connections.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.01134 · 66.2th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2023-09-06T12:19Z
EPSS history
Timeline
  • 06 SEP 12:19Z
    Apache Superset: Improper API permission for low privilege users
    cvelistv5