p PatchFirst

CVE-2024-53947

CVE-2024-53947 · Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Superset. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. This issue is a follow-up to CVE-2024-39887 with additional disallowed PostgreSQL functions now included: query_to_xml_and_xmlschema, table_to_xml, table_to_xml_and_xmlschema. This issue affects Apache Superset: <4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue or add these Postgres functions to the config set DISALLOWED_SQL_FUNCTIONS.

CVSS 2.3 · Low · EPSS 0.8% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • apache superset

    Versions
    • ≥ 0, < 4.1.0: Affected (semver)

    Update to 4.1.0

  • apache-superset PyPI

    Versions
    • 0.34.0
    • 0.34.1
    • 0.35.1
    • 0.35.2
    • 0.36.0
    • 0.37.0
    • 0.37.1
    • 0.37.2
    • 0.38.0
    • 0.38.1
    • 1.0.0
    • 1.0.1
    • 1.1.0
    • 1.2.0
    • 1.3.0
    • 1.3.1
    • 1.3.2
    • 1.4.0
    • 1.4.1
    • 1.4.2
    • 1.5.0
    • 1.5.1
    • 1.5.2
    • 1.5.3
    • 2.0.0
    • 2.0.1
    • 2.1.0
    • 2.1.1
    • 2.1.1rc1
    • 2.1.1rc2
    • 2.1.1rc3
    • 2.1.2
    • 2.1.3
    • 3.0.0
    • 3.0.0rc1
    • 3.0.0rc2
    • 3.0.0rc3
    • 3.0.0rc4
    • 3.0.1
    • 3.0.2
    • 3.0.3
    • 3.0.4
    • 3.1.0
    • 3.1.0rc1
    • 3.1.0rc2
    • 3.1.0rc3
    • 3.1.0rc4
    • 3.1.1
    • 3.1.2
    • 3.1.3
    • 4.0.0
    • 4.0.0rc1
    • 4.0.0rc2
    • 4.0.1
    • 4.0.2
    • 4.1.0rc2
    • 4.1.0rc3
    • 4.1.0rc4
    Affected ranges
    • ECOSYSTEM: < 4.1.0

    Update to 4.1.0

Original sources

Check your server →