CVE-2020-1932: Infoleak
First published: Tue Jan 28 2020(Updated: )
An information disclosure issue was found in Apache Superset 0.34.0, 0.34.1, 0.35.0, and 0.35.1. Authenticated Apache Superset users are able to retrieve other users' information, including hashed passwords, by accessing an unused and undocumented API endpoint on Apache Superset.
Credit: security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| pip/apache-superset | >=0.34.0<0.35.2 | 0.35.2 |
| Apache Superset | =0.34.0 | |
| Apache Superset | =0.34.1 | |
| Apache Superset | =0.35.0 | |
| Apache Superset | =0.35.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2020-1932
- https://lists.apache.org/thread.html/r4e5323c3bc786005495311a6ff53ac6d990b2c7eb52941a1a13ce227%40%3Cdev.superset.apache.org%3E
- https://github.com/advisories/GHSA-fxjm-wvj9-9c39 (Advisory)
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-superset/PYSEC-2020-224.yaml
Frequently Asked Questions
What is the severity of CVE-2020-1932?
The severity of CVE-2020-1932 is medium.
How does CVE-2020-1932 affect Apache Superset?
CVE-2020-1932 allows authenticated Apache Superset users to retrieve other users' information, including hashed passwords, by accessing an unused and undocumented API endpoint.
Which versions of Apache Superset are affected by CVE-2020-1932?
Apache Superset versions 0.34.0, 0.34.1, 0.35.0, and 0.35.1 are affected by CVE-2020-1932.
How can I fix CVE-2020-1932?
To fix CVE-2020-1932, upgrade Apache Superset to version 0.35.2 or higher.
What is the Common Weakness Enumeration (CWE) ID for CVE-2020-1932?
The CWE ID for CVE-2020-1932 is CWE-200.
- collector/nvd-index
- agent/softwarecombine
- agent/type
- agent/author
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/severity
- agent/description
- agent/event
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-fxjm-wvj9-9c39
- alias/CVE-2020-1932
- agent/software-canonical-lookup
- agent/references
- agent/last-modified-date
- collector/nvd-cve
- source/NVD
- collector/github-advisory
- agent/tags
- agent/trending
- vendor/apache
- canonical/apache superset
- version/apache superset/0.34.0
- version/apache superset/0.34.1
- version/apache superset/0.35.0
- version/apache superset/0.35.1
- package-manager/pip