Vulnerabilities > Apache > Superset > Medium

DATE CVE VULNERABILITY TITLE RISK
2024-02-14 CVE-2024-23952 Unspecified vulnerability in Apache Superset
This is a duplicate for CVE-2023-46104.
network
low complexity
apache
6.5
2024-01-23 CVE-2023-49657 Unspecified vulnerability in Apache Superset
A stored cross-site scripting (XSS) vulnerability exists in Apache Superset before 3.0.3. An authenticated attacker with create/update permissions on charts or dashboards could store a script or add a specific HTML snippet that would act as a stored XSS. For 2.X versions, users should change their config to include: TALISMAN_CONFIG = {     "content_security_policy": {         "base-uri": ["'self'"],         "default-src": ["'self'"],         "img-src": ["'self'", "blob:", "data:"],         "worker-src": ["'self'", "blob:"],         "connect-src": [             "'self'",             " https://api.mapbox.com" https://api.mapbox.com" ;,             " https://events.mapbox.com" https://events.mapbox.com" ;,         ],         "object-src": "'none'",         "style-src": [             "'self'",             "'unsafe-inline'",         ],         "script-src": ["'self'", "'strict-dynamic'"],     },     "content_security_policy_nonce_in": ["script-src"],     "force_https": False,     "session_cookie_secure": False, }
network
low complexity
apache
5.4
2023-12-19 CVE-2023-46104 Unspecified vulnerability in Apache Superset
Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets.   This vulnerability exists in Apache Superset versions up to and including 2.1.2 and versions 3.0.0, 3.0.1.
network
low complexity
apache
6.5
2023-12-19 CVE-2023-49734 Unspecified vulnerability in Apache Superset
An authenticated Gamma user has the ability to create a dashboard and add charts to it, this user would automatically become one of the owners of the charts allowing him to incorrectly have write permissions to these charts.This issue affects Apache Superset: before 2.1.2, from 3.0.0 before 3.0.2. Users are recommended to upgrade to version 3.0.2 or 2.1.3, which fixes the issue.
network
low complexity
apache
6.5
2023-11-28 CVE-2023-42504 Unspecified vulnerability in Apache Superset
An authenticated malicious user could initiate multiple concurrent requests, each requesting multiple dashboard exports, leading to a possible denial of service. This issue affects Apache Superset: before 3.0.0
network
low complexity
apache
6.5
2023-11-28 CVE-2023-42502 Unspecified vulnerability in Apache Superset
An authenticated attacker with update datasets permission could change a dataset link to an untrusted site by spoofing the HTTP Host header, users could be redirected to this site when clicking on that specific dataset.
network
low complexity
apache
5.4
2023-11-28 CVE-2023-42505 Unspecified vulnerability in Apache Superset
An authenticated user with read permissions on database connections metadata could potentially access sensitive information such as the connection's username. This issue affects Apache Superset before 3.0.0.
network
low complexity
apache
4.3
2023-11-27 CVE-2023-42501 Unspecified vulnerability in Apache Superset
Unnecessary read permissions within the Gamma role would allow authenticated users to read configured CSS templates and annotations. This issue affects Apache Superset: before 2.1.2. Users should upgrade to version or above 2.1.2 and run `superset init` to reconstruct the Gamma role or remove `can_read` permission from the mentioned resources.
network
low complexity
apache
4.3
2023-11-27 CVE-2023-43701 Unspecified vulnerability in Apache Superset
Improper payload validation and an improper REST API response type, made it possible for an authenticated malicious actor to store malicious code into Chart's metadata, this code could get executed if a user specifically accesses a specific deprecated API endpoint. This issue affects Apache Superset versions prior to 2.1.2.  Users are recommended to upgrade to version 2.1.2, which fixes this issue.
network
low complexity
apache
5.4
2023-09-06 CVE-2023-32672 Unspecified vulnerability in Apache Superset
An Incorrect authorisation check in SQLLab in Apache Superset versions up to and including 2.1.0.
network
low complexity
apache
4.3