Vulnerabilities > Apache > Superset > 0.15.2

DATE CVE VULNERABILITY TITLE RISK
2024-01-23 CVE-2023-49657 Cross-site Scripting vulnerability in Apache Superset
A stored cross-site scripting (XSS) vulnerability exists in Apache Superset before 3.0.3. An authenticated attacker with create/update permissions on charts or dashboards could store a script or add a specific HTML snippet that would act as a stored XSS. For 2.X versions, users should change their config to include: TALISMAN_CONFIG = {     "content_security_policy": {         "base-uri": ["'self'"],         "default-src": ["'self'"],         "img-src": ["'self'", "blob:", "data:"],         "worker-src": ["'self'", "blob:"],         "connect-src": [             "'self'",             " https://api.mapbox.com" https://api.mapbox.com" ;,             " https://events.mapbox.com" https://events.mapbox.com" ;,         ],         "object-src": "'none'",         "style-src": [             "'self'",             "'unsafe-inline'",         ],         "script-src": ["'self'", "'strict-dynamic'"],     },     "content_security_policy_nonce_in": ["script-src"],     "force_https": False,     "session_cookie_secure": False, }
network
low complexity
apache CWE-79
5.4
2023-12-19 CVE-2023-46104 Resource Exhaustion vulnerability in Apache Superset
Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets.   This vulnerability exists in Apache Superset versions up to and including 2.1.2 and versions 3.0.0, 3.0.1.
network
low complexity
apache CWE-400
6.5
2023-12-19 CVE-2023-49734 Incorrect Authorization vulnerability in Apache Superset
An authenticated Gamma user has the ability to create a dashboard and add charts to it, this user would automatically become one of the owners of the charts allowing him to incorrectly have write permissions to these charts.This issue affects Apache Superset: before 2.1.2, from 3.0.0 before 3.0.2. Users are recommended to upgrade to version 3.0.2 or 2.1.3, which fixes the issue.
network
low complexity
apache CWE-863
6.5
2023-12-19 CVE-2023-49736 SQL Injection vulnerability in Apache Superset
A where_in JINJA macro allows users to specify a quote, which combined with a carefully crafted statement would allow for SQL injection in Apache Superset.This issue affects Apache Superset: before 2.1.2, from 3.0.0 before 3.0.2. Users are recommended to upgrade to version 3.0.2, which fixes the issue.
network
low complexity
apache CWE-89
8.8
2023-11-28 CVE-2023-42504 Allocation of Resources Without Limits or Throttling vulnerability in Apache Superset
An authenticated malicious user could initiate multiple concurrent requests, each requesting multiple dashboard exports, leading to a possible denial of service. This issue affects Apache Superset: before 3.0.0
network
low complexity
apache CWE-770
6.5
2023-11-28 CVE-2023-42502 Open Redirect vulnerability in Apache Superset
An authenticated attacker with update datasets permission could change a dataset link to an untrusted site by spoofing the HTTP Host header, users could be redirected to this site when clicking on that specific dataset.
network
low complexity
apache CWE-601
5.4
2023-11-28 CVE-2023-42505 Unspecified vulnerability in Apache Superset
An authenticated user with read permissions on database connections metadata could potentially access sensitive information such as the connection's username. This issue affects Apache Superset before 3.0.0.
network
low complexity
apache
4.3
2023-11-27 CVE-2023-40610 Incorrect Authorization vulnerability in Apache Superset
Improper authorization check and possible privilege escalation on Apache Superset up to but excluding 2.1.2.
network
low complexity
apache CWE-863
8.8
2023-11-27 CVE-2023-42501 Incorrect Default Permissions vulnerability in Apache Superset
Unnecessary read permissions within the Gamma role would allow authenticated users to read configured CSS templates and annotations. This issue affects Apache Superset: before 2.1.2. Users should upgrade to version or above 2.1.2 and run `superset init` to reconstruct the Gamma role or remove `can_read` permission from the mentioned resources.
network
low complexity
apache CWE-276
4.3
2023-11-27 CVE-2023-43701 Cross-site Scripting vulnerability in Apache Superset
Improper payload validation and an improper REST API response type, made it possible for an authenticated malicious actor to store malicious code into Chart's metadata, this code could get executed if a user specifically accesses a specific deprecated API endpoint. This issue affects Apache Superset versions prior to 2.1.2.  Users are recommended to upgrade to version 2.1.2, which fixes this issue.
network
low complexity
apache CWE-79
5.4