oss-security - CVE-2023-37941: Apache Superset: Metadata db write access can lead to remote code execution

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <284ffee8-6813-45ee-1a86-1183a02755c1@apache.org>
Date: Wed, 06 Sep 2023 09:40:57 +0000
From: Daniel Gaspar <dpgaspar@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2023-37941: Apache Superset: Metadata db write access can lead
 to remote code execution 

Affected versions:

- Apache Superset 1.5.0 through 2.1.0

Description:

If an attacker gains write access to the Apache Superset metadata database, they could persist a specifically crafted Python object that may lead to remote code execution on Superset's web backend. This vulnerability impacts Apache Superset versions 1.5.0 up to and including 2.1.0.

Credit:

Dinis Cruz, cruzdinis@...pt (finder)
Naveen Sunkavally (Horizon3.ai) (finder)

References:

https://superset.apache.org
https://www.cve.org/CVERecord?id=CVE-2023-37941

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.