Back to feed
EUVD-2021-0023 · Published May 24, 2022
Apache Superset allowed for database connections password leak for authenticated users
Apache Superset up to and including 1.3.1 allowed for database connections password leak for authenticated users. This information could be accessed in a non-trivial way.
Technologies
Apache SupersetApache-Superset Apache-Superset
Weaknesses
CWE-522
CVSS scores
- v3.16.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
MITRE ATT&CK
InferredWhere this vulnerability fits in an attack
Initial Access
References
- https://lists.apache.org/thread/xpdl2r538o695o7r9gd9qrwqb17bdd3v
- https://seclists.org/oss-sec/2021/q4/106
- https://nvd.nist.gov/vuln/detail/CVE-2021-41972
- https://github.com/advisories/GHSA-42q4-9xf9-f67x
- https://github.com/apache/superset
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-superset/PYSEC-2021-434.yaml
Potentially impacted assets
See if this affects your attack surface
