GHSA-fgpw-4w69-j256

Apache Superset Exposure of Sensitive Information to an Unauthorized Actor vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-42505

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	apache-superset	< 3.0.0	3.0.0

Details

As written in the advisory (Markdown source, shown as plain text).

An authenticated user with read permissions on database connections metadata could potentially access sensitive information such as the connection's username. This issue affects Apache Superset before 3.0.0.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-42505 advisory
https://github.com/apache/superset package
https://lists.apache.org/thread/bd0fhtfzrtgo1q8x35tpm8ms144d1t2y web
http://www.openwall.com/lists/oss-security/2023/11/28/5 web