Описание
An authenticated Gamma user has the ability to create a dashboard and add charts to it, this user would automatically become one of the owners of the charts allowing him to incorrectly have write permissions to these charts.This issue affects Apache Superset: before 2.1.2, from 3.0.0 before 3.0.2.
Users are recommended to upgrade to version 3.0.2 or 2.1.3, which fixes the issue.
Ссылки
- Mailing ListThird Party Advisory
- Mailing ListVendor Advisory
- Mailing ListThird Party Advisory
- Mailing ListVendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 2.1.2 (исключая)Версия от 3.0.0 (включая) до 3.0.2 (исключая)
Одно из
cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:*
EPSS
Процентиль: 40%
0.00183
Низкий
7.7 High
CVSS3
6.5 Medium
CVSS3
Дефекты
CWE-863
Связанные уязвимости
CVSS3: 7.7
github
около 2 лет назад
Apache Superset incorrect write permissions vulnerability
EPSS
Процентиль: 40%
0.00183
Низкий
7.7 High
CVSS3
6.5 Medium
CVSS3
Дефекты
CWE-863