p PatchFirst

CVE-2022-41703

CVE-2022-41703 · Apache Superset: SQL injection vulnerability in adhoc clauses

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A vulnerability in the SQL Alchemy connector of Apache Superset allows an authenticated user with read access to a specific database to add subqueries to the WHERE and HAVING fields referencing tables on the same database that the user should not have access to, despite the user having the feature flag "ALLOW_ADHOC_SUBQUERY" disabled (default value). This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

CVSS 5.4 · Medium · EPSS 1.2% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • apache superset

    Versions
    • ≥ 2.0.0, < 2.0.1: Affected (semver)
    • ≥ 0, ≤ 1.5.2: Affected (semver)

    Update to 2.0.1

  • apache-superset PyPI

    Versions
    • 0.34.0
    • 0.34.1
    • 0.35.1
    • 0.35.2
    • 0.36.0
    • 0.37.0
    • 0.37.1
    • 0.37.2
    • 0.38.0
    • 0.38.1
    • 1.0.0
    • 1.0.1
    • 1.1.0
    • 1.2.0
    • 1.3.0
    • 1.3.1
    • 1.3.2
    • 1.4.0
    • 1.4.1
    • 1.4.2
    • 1.5.0
    • 1.5.1
    • 1.5.2
    Affected ranges
    • ECOSYSTEM: ≤ 1.5.2

    No fix published

  • apache-superset PyPI

    Versions
    • 2.0.0

    No fix published

  • apache-superset PyPI

    Versions
    • 0.34.0
    • 0.34.1
    • 0.35.1
    • 0.35.2
    • 0.36.0
    • 0.37.0
    • 0.37.1
    • 0.37.2
    • 0.38.0
    • 0.38.1
    • 1.0.0
    • 1.0.1
    • 1.1.0
    • 1.2.0
    • 1.3.0
    • 1.3.1
    • 1.3.2
    • 1.4.0
    • 1.4.1
    • 1.4.2
    • 1.5.0
    • 1.5.1
    • 1.5.2
    • 2.0.0
    Affected ranges
    • ECOSYSTEM: < 1.5.3 ∪ ≥ 2.0.0, < 2.0.1

    Update to 1.5.3; Update to 2.0.1

Original sources

Check your server →