AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

Apache SupersetGHSA-42q4-9xf9-f67x

Apache Superset allowed for database connections password leak for authenticated users

Apache Superset

CVE-2021-41972 · Published May 24, 2022 · updated Feb 5, 2025

High6.5
Fix: upgrade to 1.3.2 or later
GitHub advisory

Apache Superset up to and including 1.3.1 allowed for database connections password leak for authenticated users. This information could be accessed in a non-trivial way.

Affected versions

PackageAffectedFixed in
apache-superset
PyPI
< 1.3.21.3.2
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-522
Also known as
BIT-superset-2021-41972, CVE-2021-41972, PYSEC-2021-434

More Apache Superset advisories

All Apache Superset
Medium 5.4May 24, 2022Apache Superset Stored XSS on Dashboard markdownCVE-2021-27907fixed in 0.38.1High 8.8May 24, 2022Apache Superset OS Command InjectionCVE-2020-13948fixed in 0.37.1High 6.5May 24, 2022Improper Encoding or Escaping of Output in Apache SupersetCVE-2021-42250fixed in 1.3.2Medium 5.4May 24, 2022Apache Superset Cross-site Scripting (XSS) vulnerability on the Explore pageCVE-2021-32609fixed in 1.2.0High 8.8May 24, 2022Apache Superset SQL Injection when template processing is enabledCVE-2021-41971fixed in 1.3.1Critical 9.8Apr 14, 2022SQL injection in apache-supersetCVE-2022-27479fixed in 1.4.2