Advisoriesby IbisApache SupersetGHSA-wh73-hpcg-v32j
SQL injection in apache-superset
Fix: upgrade to 1.4.2 or later
Apache Superset before 1.4.2 is vulnerable to SQL injection in chart data requests. Users should update to 1.4.2 or higher which addresses this issue.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| apache-superset PyPI | < 1.4.2 | 1.4.2 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-89
- Also known as
- BIT-superset-2022-27479, CVE-2022-27479, PYSEC-2022-188
- nvd.nist.gov/vuln/detail/CVE-2022-27479
- github.com/advisories/GHSA-wh73-hpcg-v32j
- github.com/apache/superset
- github.com/pypa/advisory-database/tree/main/vulns/apache-superset/PYSEC-2022-188.yaml
- lists.apache.org/thread/94th50j5d0y2fw7ysx0g7w3t6jk3z7q6
- lists.apache.org/thread/ztb9b6jd9rngoxwvq8r4fhpp401o613y
- www.openwall.com/lists/oss-security/2022/04/13/3
More Apache Superset advisories
All Apache Superset
Apache Superset Stored XSS on Dashboard markdownCVE-2021-27907fixed in 0.38.1Apache Superset OS Command InjectionCVE-2020-13948fixed in 0.37.1Improper Encoding or Escaping of Output in Apache SupersetCVE-2021-42250fixed in 1.3.2Apache Superset allowed for database connections password leak for authenticated usersCVE-2021-41972fixed in 1.3.2Apache Superset Cross-site Scripting (XSS) vulnerability on the Explore pageCVE-2021-32609fixed in 1.2.0Apache Superset SQL Injection when template processing is enabledCVE-2021-41971fixed in 1.3.1