Duplicate Advisory: Apache Superset - Elevation of Privilege
Moderate severity
GitHub Reviewed
Published
Nov 27, 2023
to the GitHub Advisory Database
•
Updated Jan 10, 2024
Withdrawn
This advisory was withdrawn on Jan 10, 2024
Description
Published by the National Vulnerability Database
Nov 27, 2023
Published to the GitHub Advisory Database
Nov 27, 2023
Reviewed
Nov 28, 2023
Withdrawn
Jan 10, 2024
Last updated
Jan 10, 2024
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-f678-j579-4xf5. This link is maintained to preserve external references.
Original Description
Improper authorization check and possible privilege escalation on Apache Superset up to but excluding 2.1.2. Using the default examples database connection that allows access to both the examples schema and Apache Superset's metadata database, an attacker using a specially crafted CTE SQL statement could change data on the metadata database. This weakness could result on tampering with the authentication/authorization data.
References