GHSA-fxjg-28fm-pfxh

Apache Superset Server-Side Request Forgery vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-25504

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	apache-superset	< 2.1.0	2.1.0

Details

As written in the advisory (Markdown source, shown as plain text).

A malicious actor who has been authenticated and granted specific permissions in Apache Superset may use the import dataset feature in order to conduct Server-Side Request Forgery attacks and query internal resources on behalf of the server where Superset is deployed. This vulnerability exists in Apache Superset versions up to and including 2.0.1.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-25504 advisory
https://github.com/apache/superset package
https://lists.apache.org/thread/tdnzkocfsqg2sbbornnp9g492fn4zhtx web
http://www.openwall.com/lists/oss-security/2023/04/18/8 web