CVE-2023-36387

Summary

An improper default REST API permission for Gamma users in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma user to test database connections.

Affected Software

Weaknesses

• CWE-863: CWE-863 Incorrect Authorization

ADP Enrichment

CVE Program Container

Additional References

• https://lists.apache.org/thread/tt6s6hm8nv6s11z8bfsk3r3d9ov0ogw3
• https://github.com/apache/superset/pull/24185

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

References

• https://lists.apache.org/thread/tt6s6hm8nv6s11z8bfsk3r3d9ov0ogw3
• https://github.com/apache/superset/pull/24185

• ←Previous
• Next→