An authenticated Gamma user has the ability to create a dashboard and add charts to it, this user would automatically become one of the owners of the charts allowing him to incorrectly have write permissions to these charts.This issue affects Apache Superset: before 2.1.2, from 3.0.0 before 3.0.2.
Users are recommended to upgrade to version 3.0.2 or 2.1.3, which fixes the issue.
References
| Link | Resource |
|---|---|
| http://www.openwall.com/lists/oss-security/2023/12/19/3 | Mailing List Third Party Advisory |
| https://lists.apache.org/thread/985h6ltvtbvdoysso780kkj7x744cds5 | Mailing List Vendor Advisory |
| http://www.openwall.com/lists/oss-security/2023/12/19/3 | Mailing List Third Party Advisory |
| https://lists.apache.org/thread/985h6ltvtbvdoysso780kkj7x744cds5 | Mailing List Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 08:33
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://www.openwall.com/lists/oss-security/2023/12/19/3 - Mailing List, Third Party Advisory | |
| References | () https://lists.apache.org/thread/985h6ltvtbvdoysso780kkj7x744cds5 - Mailing List, Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.7 |
28 Dec 2023, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Apache
Apache superset |
|
| CPE | cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
| References | () https://lists.apache.org/thread/985h6ltvtbvdoysso780kkj7x744cds5 - Mailing List, Vendor Advisory | |
| References | () http://www.openwall.com/lists/oss-security/2023/12/19/3 - Mailing List, Third Party Advisory |
19 Dec 2023, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-12-19 10:15
Updated : 2024-11-21 08:33
NVD link : CVE-2023-49734
Mitre link : CVE-2023-49734
CVE.ORG link : CVE-2023-49734
JSON object : View
Products Affected
apache
- superset
CWE
CWE-863
Incorrect Authorization