AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Apache SupersetGHSA-fgpw-4w69-j256

Apache Superset Exposure of Sensitive Information to an Unauthorized Actor vulnerability

Apache Superset

CVE-2023-42505 · Published Nov 28, 2023 · updated Jul 7, 2026

Medium4.3
Fix: upgrade to 3.0.0 or later
GitHub advisory

An authenticated user with read permissions on database connections metadata could potentially access sensitive information such as the connection's username.

This issue affects Apache Superset before 3.0.0.

Affected versions

PackageAffectedFixed in
apache-superset
PyPI
< 3.0.03.0.0
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-200
Also known as
BIT-superset-2023-42505, CVE-2023-42505, PYSEC-2026-1174

More Apache Superset advisories

All Apache Superset
Medium 6.5Dec 19, 2023Apache Superset SQL injection vulnerabilityCVE-2023-49736fixed in 2.1.3 +1High 7.3Nov 28, 2023Apache Superset - Elevation of PrivilegeCVE-2023-40610fixed in 2.1.2Medium 6.5Nov 28, 2023Apache Superset Allocation of Resources Without Limits or Throttling vulnerabilityCVE-2023-42504fixed in 3.0.0Medium 5.4Nov 28, 2023Apache Superset Open Redirect vulnerabilityCVE-2023-42502fixed in 3.0.0Medium 4.3Nov 27, 2023Apache Superset has Incorrect Default PermissionsCVE-2023-42501fixed in 2.1.2Medium 4.3Nov 27, 2023Apache Superset Cross-site Scripting vulnerabilityCVE-2023-43701fixed in 2.1.2