PT-2023-31315 · Apache · Apache Superset

Jack Prince-Fulls

·

CVE-2023-49736

·

Publicado

2023-12-19

·

Atualizado

2026-07-07

CVSS v3.1

6.5

Média

VetorAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions Apache Superset versions prior to 2.1.2 Apache Superset versions 3.0.0 through 3.0.1
Description A where in JINJA macro allows users to specify a quote, which combined with a carefully crafted statement would allow for SQL injection in Apache Superset.
Recommendations For Apache Superset versions prior to 2.1.2, upgrade to version 2.1.2 or later. For Apache Superset versions 3.0.0 through 3.0.1, upgrade to version 3.0.2.

Exploit

Correção

SQL injection

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

BIT-SUPERSET-2023-49736
CVE-2023-49736
GHSA-JFXJ-XF67-X723
PYSEC-2026-1184

Produtos afetados

Apache Superset