CVE-2022-41703

Katalog CVE

CVSS 5.4 · Medium EPSS 1,2%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') pada apache superset. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

A vulnerability in the SQL Alchemy connector of Apache Superset allows an authenticated user with read access to a specific database to add subqueries to the WHERE and HAVING fields referencing tables on the same database that the user should not have access to, despite the user having the feature flag "ALLOW_ADHOC_SUBQUERY" disabled (default value). This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

Rincian

Terbit di NVD

16 Januari 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 67,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/g7jjw0okxjk5y57pbbxy19ydw42kqcos mailing list · advisory pihak ketiga