GHSA-fxjm-wvj9-9c39

Information disclosure in Apache Superset

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-1932

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	apache-superset	>= 0.34.0, < 0.35.2	0.35.2

Details

As written in the advisory (Markdown source, shown as plain text).

An information disclosure issue was found in Apache Superset 0.34.0, 0.34.1, 0.35.0, and 0.35.1. Authenticated Apache Superset users are able to retrieve other users' information, including hashed passwords, by accessing an unused and undocumented API endpoint on Apache Superset.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-1932 advisory
https://github.com/apache/superset package
https://github.com/pypa/advisory-database/tree/main/vulns/apache-superset/PYSEC-2020-224.yaml web
https://lists.apache.org/thread.html/r4e5323c3bc786005495311a6ff53ac6d990b2c7eb52941a1a13ce227%40%3Cdev.superset.apache.org%3E web