medium5.3
CVE-2022-45438
Apache Superset has Improper Access Control
Impact
When explicitly enabling the feature flag `DASHBOARD_CACHE` (disabled by default), the system allowed for an unauthenticated user to access dashboard configuration metadata using a REST API Get endpoint. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | apache-superset | <= 1.5.2 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Superset | through 1.5.2 Version 2.0.0 |