CVE-2023-46104

Опубликовано: 19 дек. 2023

Источник: nvd

CVSS3: 6.5

EPSS Низкий

Описание

Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets. This vulnerability exists in Apache Superset versions up to and including 2.1.2 and versions 3.0.0, 3.0.1.

Ссылки

http://www.openwall.com/lists/oss-security/2023/12/19/1
Mailing List
http://www.openwall.com/lists/oss-security/2024/02/14/2
http://www.openwall.com/lists/oss-security/2024/02/14/3
https://lists.apache.org/thread/yxbxg4wryb7cb7wyybk11l5nqy0rsrvl
Vendor Advisory
http://www.openwall.com/lists/oss-security/2023/12/19/1
Mailing List
http://www.openwall.com/lists/oss-security/2024/02/14/2
http://www.openwall.com/lists/oss-security/2024/02/14/3
https://lists.apache.org/thread/yxbxg4wryb7cb7wyybk11l5nqy0rsrvl
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:*

Версия до 2.1.3 (исключая)

cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:*

Версия от 3.0.0 (включая) до 3.0.1 (исключая)

EPSS

Процентиль: 66%

0.00512

Низкий

6.5 Medium

CVSS3

Дефекты

CWE-400

Связанные уязвимости

GHSA-95mg-jgfx-54v9