Skip to main content

Superset CVE-2023-25504

MEDIUM
Server-Side Request Forgery (SSRF) (CWE-918)
2023-04-17 security@apache.org
6.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
Apr 17, 2023 - 17:15 nvd
MEDIUM 6.5

DescriptionNVD

A malicious actor who has been authenticated and granted specific permissions in Apache Superset may use the import dataset feature in order to conduct Server-Side Request Forgery attacks and query internal resources on behalf of the server where Superset is deployed. This vulnerability exists in Apache Superset versions up to and including 2.0.1.

AnalysisAI

A malicious actor who has been authenticated and granted specific permissions in Apache Superset may use the import dataset feature in order to conduct Server-Side Request Forgery attacks and query. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Server-Side Request Forgery (SSRF) (CWE-918), which allows attackers to make the server perform requests to unintended internal or external resources. A malicious actor who has been authenticated and granted specific permissions in Apache Superset may use the import dataset feature in order to conduct Server-Side Request Forgery attacks and query internal resources on behalf of the server where Superset is deployed. This vulnerability exists in Apache Superset versions up to and including 2.0.1. Affected products include: Apache Superset.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate and allowlist destination URLs, block requests to internal networks, use network segmentation.

CVE-2023-27524 CRITICAL POC
9.8 Apr 24

Session Validation attacks in Apache Superset versions up to and including 2.0.1. Rated critical severity (CVSS 9.8), th

CVE-2024-39887 CRITICAL POC
9.8 Jul 16

An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL

CVE-2018-8021 CRITICAL POC
9.8 Nov 07

Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to pos

CVE-2023-37941 MEDIUM POC
6.6 Sep 06

If an attacker gains write access to the Apache Superset metadata database, they could persist a specifically crafted Py

CVE-2023-39265 MEDIUM POC
6.5 Sep 06

Apache Superset would allow for SQLite database connections to be incorrectly registered when an attacker uses alternati

CVE-2023-40610 HIGH POC
8.8 Nov 27

Improper authorization check and possible privilege escalation on Apache Superset up to but excluding 2.1.2. Rated high

CVE-2022-27479 CRITICAL
9.8 Apr 13

Apache Superset before 1.4.2 is vulnerable to SQL injection in chart data requests. Rated critical severity (CVSS 9.8),

CVE-2023-49736 HIGH
8.8 Dec 19

A where_in JINJA macro allows users to specify a quote, which combined with a carefully crafted statement would allow fo

CVE-2021-41971 HIGH
8.8 Oct 18

Apache Superset up to and including 1.3.0 when configured with ENABLE_TEMPLATE_PROCESSING on (disabled by default) allow

CVE-2020-13948 HIGH
8.8 Sep 17

While investigating a bug report on Apache Superset, it was determined that an authenticated user could craft requests v

CVE-2020-13952 HIGH
8.1 Sep 30

In the course of work on the open source project it was discovered that authenticated users running queries against Hive

CVE-2024-53949 HIGH
7.6 Dec 09

Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default). Rate

Share

CVE-2023-25504 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy