GHSA-42q4-9xf9-f67x

Apache Superset allowed for database connections password leak for authenticated users

Source: GitHub Advisory Database (reviewed) High CVE-2021-41972

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	apache-superset	< 1.3.2	1.3.2

Details

As written in the advisory (Markdown source, shown as plain text).

Apache Superset up to and including 1.3.1 allowed for database connections password leak for authenticated users. This information could be accessed in a non-trivial way.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-41972 advisory
https://github.com/advisories/GHSA-42q4-9xf9-f67x advisory
https://github.com/apache/superset web
https://github.com/pypa/advisory-database/tree/main/vulns/apache-superset/PYSEC-2021-434.yaml web
https://lists.apache.org/thread/xpdl2r538o695o7r9gd9qrwqb17bdd3v web
https://seclists.org/oss-sec/2021/q4/106 web