CVE-2024-27315CWE-209

Apache Superset: Improper error handling on alerts

Medium · published February 28, 2024

CVSS v3.1
4.3
EPSS
1%
Percentile
61.8
In the wild
Unconfirmed
What it is

An authenticated user with privileges to create Alerts on Alerts & Reports has the capability to generate a specially crafted SQL statement that triggers an error on the database. This error is not properly handled by Apache Superset and may inadvertently surface in the error log of the Alert exposing possibly sensitive data.

This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1.

Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00978 · 61.8th percentile
Weakness
CWE-209 · Generation of Error Message Containing Sensitive Information
Published
2024-02-28T10:06Z
EPSS history
Timeline
  • 28 FEB 10:06Z
    Apache Superset: Improper error handling on alerts
    cvelistv5