high6.5
CVE-2021-41972
Apache Superset allowed for database connections password leak for authenticated users
Impact
Apache Superset up to and including 1.3.1 allowed for database connections password leak for authenticated users. This information could be accessed in a non-trivial way.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | apache-superset | <= 1.3.1 | 1.3.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Superset | through 1.3.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://lists.apache.org/thread/xpdl2r538o695o7r9gd9qrwqb17bdd3v
- https://seclists.org/oss-sec/2021/q4/106
- https://github.com/advisories/GHSA-42q4-9xf9-f67x
- https://nvd.nist.gov/vuln/detail/CVE-2021-41972
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-superset/PYSEC-2021-434.yaml