~ / search / GHSA-5474-f7g5-273q

GHSA-5474-f7g5-273q

Apache Superset: Improper validation of SQL statements allows for unauthorized access to data

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-24773

Packages

EcosystemPackageAffectedFixed in
PyPI apache-superset < 3.0.4 3.0.4
PyPI apache-superset >= 3.1.0, < 3.1.1 3.1.1

Details

As written in the advisory (Markdown source, shown as plain text).

Improper parsing of nested SQL statements on SQLLab would allow authenticated users to surpass their data authorization scope. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1, which fixes the issue.

References

External links from the advisory. They lead to third-party sites.