Vulnerabilities

TI-2024-36113 CVE-2024-53949 · GHSA-35fc-9hrj-3585

Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled

LOW 36

Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default).

CVSS 4.0HIGH 7.6 Network Low privileges No interaction EPSS 0.00716 Published 2024-12-09 Fixed in 4.1.0 CWE-863

TI-2024-36112 CVE-2024-53948 · GHSA-2cx9-54hp-r698

LOW 26

Generation of Error Message Containing analytics metadata Information in Apache Superset.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00855 Published 2024-12-09 Fixed in 4.1.0 CWE-209

TI-2024-36111 CVE-2024-53947 · GHSA-92qf-8gh3-gwcm

LOW 14

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Superset.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00836 Published 2024-12-09 Fixed in 4.1.0 CWE-89