PT-2025-33272 · Apache · Apache Superset
CVSS v4.0
5.3
Medium
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions:
Apache Superset versions prior to 4.1.3
Description:
A guest user accessing a chart in Apache Superset receives an API response from the
/chart/data endpoint that includes a query field. This field improperly discloses database schema information, such as table names, to the low-privileged guest user.Recommendations:
Upgrade to version 4.1.3.
Exploit
Fix
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Apache Superset