CVE-2023-37941CWE-502

Apache Superset: Metadata db write access can lead to remote code execution

Medium · published September 6, 2023

CVSS v3.1
6.6
EPSS
35%
Percentile
98.5
In the wild
Unconfirmed
What it is

If an attacker gains write access to the Apache Superset metadata database, they could persist a specifically crafted Python object that may lead to remote code execution on Superset's web backend.

The Superset metadata db is an 'internal' component that is typically

only accessible directly by the system administrator and the superset

process itself. Gaining access to that database should

be difficult and require significant privileges.

This vulnerability impacts Apache Superset versions 1.5.0 up to and including 2.1.0. Users are recommended to upgrade to version 2.1.1 or later.

The record
Technical detail
CVSS v3.1
6.6 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.35455 · 98.5th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2023-09-06T13:06Z
EPSS history
Timeline
  • 06 SEP 13:06Z
    Apache Superset: Metadata db write access can lead to remote code execution
    cvelistv5