oss-security - CVE-2023-27525: Apache Superset: Incorrect default permissions for Gamma role

Message-ID: <924ee784-a22c-0317-10bf-1cf40789cf80@apache.org>
Date: Mon, 17 Apr 2023 10:04:21 +0000
From: Daniel Gaspar <dpgaspar@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2023-27525: Apache Superset: Incorrect default permissions for
 Gamma role 

Description:

An authenticated user with Gamma role authorization could have access to metadata information using non trivial methods in Apache Superset up to and including 2.0.1

Credit:

NTT DATA (finder)

References:

https://superset.apache.org
https://www.cve.org/CVERecord?id=CVE-2023-27525

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.