~ / search / GHSA-92qf-8gh3-gwcm

GHSA-92qf-8gh3-gwcm

Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions

Source: GitHub Advisory Database (reviewed) Low CVE-2024-53947

Packages

EcosystemPackageAffectedFixed in
PyPI apache-superset < 4.1.0 4.1.0

Details

As written in the advisory (Markdown source, shown as plain text).

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Superset. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. This issue is a follow-up to CVE-2024-39887 with additional disallowed PostgreSQL functions now included: query_to_xml_and_xmlschema, table_to_xml, table_to_xml_and_xmlschema. This issue affects Apache Superset: <4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue or add these Postgres functions to the config set DISALLOWED_SQL_FUNCTIONS.

References

External links from the advisory. They lead to third-party sites.