p PatchFirst

CVE-2021-37839

CVE-2021-37839 · Improper access to dataset metadata information

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Apache Superset up to 1.5.1 allowed for authenticated users to access metadata information related to datasets they have no permission on. This metadata included the dataset name, columns and metrics.

CVSS 4.3 · Medium · EPSS 1.4% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • apache superset

    Versions
    • ≥ Apache Superset, < 1.5.1: Affected (custom)

    Update to 1.5.1

  • apache-superset PyPI

    Versions
    • 0.34.0
    • 0.34.1
    • 0.35.1
    • 0.35.2
    • 0.36.0
    • 0.37.0
    • 0.37.1
    • 0.37.2
    • 0.38.0
    • 0.38.1
    • 1.0.0
    • 1.0.1
    • 1.1.0
    • 1.2.0
    • 1.3.0
    • 1.3.1
    • 1.3.2
    • 1.4.0
    • 1.4.1
    • 1.4.2
    • 1.5.0
    Affected ranges
    • ECOSYSTEM: < 1.5.1

    Update to 1.5.1

Original sources

Check your server →