CVE-2023-42501CWE-276

Apache Superset: Unnecessary read permissions within the Gamma role

Medium · published November 27, 2023

CVSS v3.1
4.3
EPSS
1%
Percentile
58.1
In the wild
Unconfirmed
What it is

Unnecessary read permissions within the Gamma role would allow authenticated users to read configured CSS templates and annotations.

This issue affects Apache Superset: before 2.1.2.

Users should upgrade to version or above 2.1.2 and run `superset init` to reconstruct the Gamma role or remove `can_read` permission from the mentioned resources.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00860 · 58.1th percentile
Weakness
CWE-276 · Incorrect Default Permissions
Published
2023-11-27T10:23Z
EPSS history
Timeline
  • 27 NOV 10:23Z
    Apache Superset: Unnecessary read permissions within the Gamma role
    cvelistv5