p PatchFirst

CVE-2023-49734

CVE-2023-49734 · Apache Superset: Privilege Escalation Vulnerability

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An authenticated Gamma user has the ability to create a dashboard and add charts to it, this user would automatically become one of the owners of the charts allowing him to incorrectly have write permissions to these charts.This issue affects Apache Superset: before 2.1.2, from 3.0.0 before 3.0.2. Users are recommended to upgrade to version 3.0.2 or 2.1.3, which fixes the issue.

CVSS 7.7 · High · EPSS 0.9% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • apache superset

    Versions
    • ≥ 0, < 2.1.2: Affected (semver)
    • ≥ 3.0.0, < 3.0.2: Affected (semver)

    Update to 2.1.2; Update to 3.0.2

  • apache-superset PyPI

    Versions
    • 0.34.0
    • 0.34.1
    • 0.35.1
    • 0.35.2
    • 0.36.0
    • 0.37.0
    • 0.37.1
    • 0.37.2
    • 0.38.0
    • 0.38.1
    • 1.0.0
    • 1.0.1
    • 1.1.0
    • 1.2.0
    • 1.3.0
    • 1.3.1
    • 1.3.2
    • 1.4.0
    • 1.4.1
    • 1.4.2
    • 1.5.0
    • 1.5.1
    • 1.5.2
    • 1.5.3
    • 2.0.0
    • 2.0.1
    • 2.1.0
    • 2.1.1
    • 2.1.1rc1
    • 2.1.1rc2
    • 2.1.1rc3
    • 2.1.2
    Affected ranges
    • ECOSYSTEM: < 2.1.3

    Update to 2.1.3

  • apache-superset PyPI

    Versions
    • 3.0.0
    • 3.0.1
    Affected ranges
    • ECOSYSTEM: ≥ 3.0.0, < 3.0.2

    Update to 3.0.2

  • apache-superset PyPI

    Versions
    • 0.34.0
    • 0.34.1
    • 0.35.1
    • 0.35.2
    • 0.36.0
    • 0.37.0
    • 0.37.1
    • 0.37.2
    • 0.38.0
    • 0.38.1
    • 1.0.0
    • 1.0.1
    • 1.1.0
    • 1.2.0
    • 1.3.0
    • 1.3.1
    • 1.3.2
    • 1.4.0
    • 1.4.1
    • 1.4.2
    • 1.5.0
    • 1.5.1
    • 1.5.2
    • 1.5.3
    • 2.0.0
    • 2.0.1
    • 2.1.0
    • 2.1.1
    • 2.1.1rc1
    • 2.1.1rc2
    • 2.1.1rc3
    • 2.1.2
    • 3.0.0
    • 3.0.1
    Affected ranges
    • ECOSYSTEM: < 2.1.3 ∪ ≥ 3.0.0, < 3.0.2

    Update to 2.1.3; Update to 3.0.2

Original sources

Check your server →