medium4.3
CVE-2024-24772
Apache Superset: Improper Neutralization of custom SQL on embedded context
Impact
A guest user could exploit a chart data REST API and send arbitrary SQL statements that on error could leak information from the underlying analytics database.This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | apache-superset | <= 3.0.3 | 3.0.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Superset | before 3.0.4 from 3.1.0 before 3.1.1 |