An authenticated user could potentially access metadata for a datasource they are not authorized to view by submitting a targeted REST API request.This issue affects Apache Superset: before 3.1.2.
Users are recommended to upgrade to version 3.1.2 or above, which fixes the issue.
References
| Link | Resource |
|---|---|
| https://lists.apache.org/thread/n27wlbd05oc6bgjh28d5pxzsrrph8dgo | Mailing List |
| https://lists.apache.org/thread/n27wlbd05oc6bgjh28d5pxzsrrph8dgo | Mailing List |
Configurations
History
11 Feb 2025, 16:33
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://lists.apache.org/thread/n27wlbd05oc6bgjh28d5pxzsrrph8dgo - Mailing List | |
| CWE | ||
| First Time |
Apache superset
Apache |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.3 |
| CPE | cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:* |
08 May 2024, 09:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | An authenticated user could potentially access metadata for a datasource they are not authorized to view by submitting a targeted REST API request.This issue affects Apache Superset: before 3.1.2. Users are recommended to upgrade to version 3.1.2 or above, which fixes the issue. |
07 May 2024, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-05-07 14:15
Updated : 2025-02-11 16:33
NVD link : CVE-2024-28148
Mitre link : CVE-2024-28148
JSON object : View
Products Affected
apache
- superset
CWE
No CWE.