Apache Superset any version

Apache Superset: Session validation vulnerability when using provided default SECRET_KEY

Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to possible remote code execution. Note Superset 0.23 was released prior to any Superset release under the Apache Software Foundation.

Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions

SQL injection vulnerability in chart data API

Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions

Apache Superset: Stored XSS in Dashboard Title and Chart Title

While investigating a bug report on Apache Superset, it was determined that an authenticated user could craft requests via a number of templated text fields in the product that would allow arbitrary access to Python’s `os` package in the web application process in versions < 0.37.1. It was thus possible for an authenticated user to list and access files, environment variables, and process information. Additionally it was possible to set environment variables for the current process, create and update files in folders writable by the web process, and execute arbitrary programs accessible by the web process. All other operations available to the `os` package in Python were also available, even if not explicitly enumerated in this CVE.

Possible SQL Injection when template processing is enabled

Apache Superset: Privilege escalation with default examples database

Apache Superset: Incorrect authorization leading to resource ownership takeover

Apache Superset: SQL Injection on where_in JINJA macro

Apache Superset: Cross Site Request Forgery (CSRF) on accept, request access API

In the course of work on the open source project it was discovered that authenticated users running queries against Hive and Presto database engines could access information via a number of templated fields including the contents of query description metadata database, the hashed version of the authenticated users’ password, and access to connection information including the plaintext password for the current connection. It would also be possible to run arbitrary methods on the database connection object for the Presto or Hive connection, allowing the user to bypass security controls internal to Superset. This vulnerability is present in every Apache Superset version < 0.37.2.

Apache Superset: Privilege Escalation Vulnerability

Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled

Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access

Apache Superset: Improper authorization bypass on row level security via SQL Injection

Apache Superset: Improper Authorization in Dataset Creation Allows Access Control Bypass

Apache Superset: SQLLab Read-Only Bypass on PostgreSQL

Apache Superset: Server arbitrary file read

Apache Superset: Metadata db write access can lead to remote code execution

Apache Superset: Possible Unauthorized Registration of SQLite Database Connections

API sensitive information leak

Apache Superset: Database connection password leak

Possible log injection

Apache Superset: Allows for uncontrolled resource consumption via a ZIP bomb (version range fix for CVE-2023-46104)

Apache Superset: Allows for uncontrolled resource consumption via a ZIP bomb

Credentials leak

Apache Superset: Lack of rate limiting allows for possible denial of service

Apache Superset: Possible SSRF on import datasets

Apache Superset: Improper validation of SQL statements allows for unauthorized access to data

Apache Superset: Improper data authorization when creating a new dataset

Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions

Apache Superset: Improper Neutralization of Special Elements used in a SQL Command

Apache Superset: Exposure of Sensitive Information via Incomplete ClickHouse Function Filtering

Apache Superset: Incorrect datasource authorization on REST API

Apache Superset: Sensitive Data Exposure via REST API (disabled by default)

Apache Superset: Regular Expression Denial of Service (ReDoS) in SQL Parser

Apache Superset Open Redirect

Apache Superset stored XSS on Dashboard markdown