AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

Apache SupersetGHSA-9c29-9h4m-wg5p

Users can view database names in Apache Superset

Apache Superset

CVE-2019-12414 · Published Feb 26, 2020 · updated Sep 5, 2024

Medium5.3
Fix: upgrade to 0.32.0 or later
GitHub advisory

In Apache Incubator Superset before 0.32, a user can view database names that he has no access to on a dropdown list in SQLLab

Affected versions

PackageAffectedFixed in
apache-superset
PyPI
< 0.32.00.32.0
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-200
Also known as
CVE-2019-12414, PYSEC-2019-173

More Apache Superset advisories

All Apache Superset
Critical 9.8Apr 14, 2022SQL injection in apache-supersetCVE-2022-27479fixed in 1.4.2High 6.5Feb 2, 2022Insufficiently Protected Credentials in Apache SupersetCVE-2021-44451fixed in 1.4.0Medium 6.1Oct 6, 2021Open Redirect in Apache SupersetCVE-2021-28125fixed in 1.1.0High 8.1Apr 30, 2021Plaintext password leak in Apache SupersetCVE-2020-13952fixed in 0.37.2Medium 5.3Feb 26, 2020Users able to query database metadata in Apache SupersetCVE-2019-12413fixed in 0.31.0Medium 6.5Feb 26, 2020Information disclosure in Apache SupersetCVE-2020-1932fixed in 0.35.2