CVE-2024-24779CWE-863

Apache Superset: Improper data authorization when creating a new dataset

Medium · published February 28, 2024

CVSS v3.1
5.0
EPSS
1%
Percentile
53.9
In the wild
Unconfirmed
What it is

Apache Superset with custom roles that include `can write on dataset` and without all data access permissions, allows for users to create virtual datasets to data they don't have access to. These users could then use those virtual datasets to get access to unauthorized data.

This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1.

Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue.

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00733 · 53.9th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2024-02-28T11:28Z
EPSS history
Timeline
  • 28 FEB 11:28Z
    Apache Superset: Improper data authorization when creating a new dataset
    cvelistv5