AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Apache SupersetGHSA-hhm3-48h2-597v

Insufficiently Protected Credentials in Apache Superset

Apache Superset

CVE-2021-44451 · Published Feb 2, 2022 · updated Feb 5, 2025

High6.5
Fix: upgrade to 1.4.0 or later
GitHub advisory

Apache Superset up to and including 1.3.2 allowed for registered database connections password leak for authenticated users. This information could be accessed in a non-trivial way. Users should upgrade to Apache Superset 1.4.0 or higher.

Affected versions

PackageAffectedFixed in
apache-superset
PyPI
< 1.4.01.4.0
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-522
Also known as
BIT-superset-2021-44451, CVE-2021-44451, PYSEC-2022-36

More Apache Superset advisories

All Apache Superset
High 8.8May 24, 2022Apache Superset OS Command InjectionCVE-2020-13948fixed in 0.37.1High 6.5May 24, 2022Improper Encoding or Escaping of Output in Apache SupersetCVE-2021-42250fixed in 1.3.2High 6.5May 24, 2022Apache Superset allowed for database connections password leak for authenticated usersCVE-2021-41972fixed in 1.3.2Medium 5.4May 24, 2022Apache Superset Cross-site Scripting (XSS) vulnerability on the Explore pageCVE-2021-32609fixed in 1.2.0High 8.8May 24, 2022Apache Superset SQL Injection when template processing is enabledCVE-2021-41971fixed in 1.3.1Critical 9.8Apr 14, 2022SQL injection in apache-supersetCVE-2022-27479fixed in 1.4.2