CVE-2023-40610

Katalog CVE

CVSS 8.8 · High EPSS 1,3%

Kerentanan Incorrect Authorization pada apache superset. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Improper authorization check and possible privilege escalation on Apache Superset up to but excluding 2.1.2. Using the default examples database connection that allows access to both the examples schema and Apache Superset's metadata database, an attacker using a specially crafted CTE SQL statement could change data on the metadata database. This weakness could result on tampering with the authentication/authorization data.

Rincian

Terbit di NVD

27 November 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

1,3% peluang dieksploitasi; lebih tinggi dari 70,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/jvgxpk4dbxyqtsgtl4pdgbd520rc0rot mailing list · advisory vendor
• http://www.openwall.com/lists/oss-security/2023/11/27/2 mailing list · advisory pihak ketiga
• https://github.com/orangecertcc/security-research/security/advisories/GHSA-f678-j579-4xf5