CVE-2023-36388CWE-918

Apache Superset: Improper API permission for low privilege users allows for SSRF

Medium · published September 6, 2023

CVSS v3.1
4.3
EPSS
1%
Percentile
65.7
In the wild
Unconfirmed
What it is

Improper REST API permission in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma users to test network connections, possible SSRF.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01113 · 65.7th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2023-09-06T12:53Z
EPSS history
Timeline
  • 06 SEP 12:53Z
    Apache Superset: Improper API permission for low privilege users allows for SSRF
    cvelistv5