AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Apache SupersetGHSA-fxjg-28fm-pfxh

Apache Superset Server-Side Request Forgery vulnerability

Apache Superset

CVE-2023-25504 · Published Jul 6, 2023 · updated Jul 7, 2026

Medium6.5
Fix: upgrade to 2.1.0 or later
GitHub advisory

A malicious actor who has been authenticated and granted specific permissions in Apache Superset may use the import dataset feature in order to conduct Server-Side Request Forgery attacks and query internal resources on behalf of the server where Superset is deployed. This vulnerability exists in Apache Superset versions up to and including 2.0.1.

Affected versions

PackageAffectedFixed in
apache-superset
PyPI
< 2.1.02.1.0
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-918
Also known as
BIT-superset-2023-25504, CVE-2023-25504, PYSEC-2026-1179

More Apache Superset advisories

All Apache Superset
Medium 5.0Sep 6, 2023Apache Superset vulnerable to improper data authorizationCVE-2023-27523no fix yetMedium 4.3Sep 6, 2023Apache Superset may expose internal traces on REST API endpointsCVE-2023-39264no fix yetMedium 4.3Sep 6, 2023Apache Superset users may incorrectly create resources using the import charts featureCVE-2023-27526no fix yetMedium 5.4Sep 6, 2023Apache Superset has improper default REST API permission for Gamma usersCVE-2023-36387no fix yetMedium 4.3Sep 6, 2023Apache Superset Server Side Request Forgery vulnerabilityCVE-2023-36388no fix yetMedium 6.5Jul 6, 2023Apache Superset vulnerable to Exposure of Sensitive InformationCVE-2023-30776fixed in 2.1.0