p PatchFirst

CVE-2020-13952

CVE-2020-13952

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In the course of work on the open source project it was discovered that authenticated users running queries against Hive and Presto database engines could access information via a number of templated fields including the contents of query description metadata database, the hashed version of the authenticated users’ password, and access to connection information including the plaintext password for the current connection. It would also be possible to run arbitrary methods on the database connection object for the Presto or Hive connection, allowing the user to bypass security controls internal to Superset. This vulnerability is present in every Apache Superset version < 0.37.2.

CVSS 8.6 · High · EPSS 2.0% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • apache superset

    Versions
    • Apache Superset < 0.37.2: Affected

    No fix published

  • apache-superset PyPI

    Versions
    • 0.34.0
    • 0.34.1
    • 0.35.1
    • 0.35.2
    • 0.36.0
    • 0.37.0
    • 0.37.1
    Affected ranges
    • ECOSYSTEM: < 0.37.2

    Update to 0.37.2

Original sources

Check your server →