CVE-2023-39264CWE-209

Apache Superset: Stack traces enabled by default

Medium · published September 6, 2023

CVSS v3.1
4.3
EPSS
1%
Percentile
66.1
In the wild
Unconfirmed
What it is

By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vulnerability exists in Apache Superset versions up to and including 2.1.0.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01128 · 66.1th percentile
Weakness
CWE-209 · Generation of Error Message Containing Sensitive Information
Published
2023-09-06T12:58Z
EPSS history
Timeline
  • 06 SEP 12:58Z
    Apache Superset: Stack traces enabled by default
    cvelistv5