Apache: >> Superset >> 2.1.2 Security Vulnerabilities
Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets.
This vulnerability exists in Apache Superset versions up to and including 2.1.2 and versions 3.0.0, 3.0.1.
CVSS Score
6.5
EPSS Score
0.004
Published
2023-12-19
An authenticated malicious user could initiate multiple concurrent requests, each requesting multiple dashboard exports, leading to a possible denial of service.
This issue affects Apache Superset: before 3.0.0
CVSS Score
5.8
EPSS Score
0.002
Published
2023-11-28
An authenticated user with read permissions on database connections metadata could potentially access sensitive information such as the connection's username.
This issue affects Apache Superset before 3.0.0.
CVSS Score
4.3
EPSS Score
0.0
Published
2023-11-28
An authenticated attacker with update datasets permission could change a dataset link to an untrusted site by spoofing the HTTP Host header, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset versions before 3.0.0.
CVSS Score
4.8
EPSS Score
0.001
Published
2023-11-28
Page 3