Vulnerabilities > CVE-2022-45438 - Exposure of Resource to Wrong Sphere vulnerability in Apache Superset

047910
CVSS 5.3 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
LOW
Integrity impact
NONE
Availability impact
NONE
network
low complexity
apache
CWE-668
NVD
Published: 2023-01-16
Updated: 2023-11-07

Summary

When explicitly enabling the feature flag DASHBOARD_CACHE (disabled by default), the system allowed for an unauthenticated user to access dashboard configuration metadata using a REST API Get endpoint. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

Vulnerable Configurations

Part Description Count
Application
Apache
213

Common Weakness Enumeration (CWE)

References