AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Apache SupersetGHSA-fxjm-wvj9-9c39

Information disclosure in Apache Superset

Apache Superset

CVE-2020-1932 · Published Feb 26, 2020 · updated Feb 5, 2025

Medium6.5
Fix: upgrade to 0.35.2 or later
GitHub advisory

An information disclosure issue was found in Apache Superset 0.34.0, 0.34.1, 0.35.0, and 0.35.1. Authenticated Apache Superset users are able to retrieve other users' information, including hashed passwords, by accessing an unused and undocumented API endpoint on Apache Superset.

Affected versions

PackageAffectedFixed in
apache-superset
PyPI
>= 0.34.0, < 0.35.20.35.2
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-200
Also known as
BIT-superset-2020-1932, CVE-2020-1932, PYSEC-2020-224

More Apache Superset advisories

All Apache Superset
Critical 9.8Apr 14, 2022SQL injection in apache-supersetCVE-2022-27479fixed in 1.4.2High 6.5Feb 2, 2022Insufficiently Protected Credentials in Apache SupersetCVE-2021-44451fixed in 1.4.0Medium 6.1Oct 6, 2021Open Redirect in Apache SupersetCVE-2021-28125fixed in 1.1.0High 8.1Apr 30, 2021Plaintext password leak in Apache SupersetCVE-2020-13952fixed in 0.37.2Medium 5.3Feb 26, 2020Users able to query database metadata in Apache SupersetCVE-2019-12413fixed in 0.31.0Medium 5.3Feb 26, 2020Users can view database names in Apache SupersetCVE-2019-12414fixed in 0.32.0