CVE-2020-1932: Infoleak
An information disclosure issue was found in Apache Superset 0.34.0, 0.34.1, 0.35.0, and 0.35.1. Authenticated Apache Superset users are able to retrieve other users' information, including hashed passwords, by accessing an unused and undocumented API endpoint on Apache Superset.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/apache-supersetto a version that resolves this vulnerability.Fixed in 0.35.2
Event History
Frequently Asked Questions
What is the severity of CVE-2020-1932?
The severity of CVE-2020-1932 is medium.
How does CVE-2020-1932 affect Apache Superset?
CVE-2020-1932 allows authenticated Apache Superset users to retrieve other users' information, including hashed passwords, by accessing an unused and undocumented API endpoint.
Which versions of Apache Superset are affected by CVE-2020-1932?
Apache Superset versions 0.34.0, 0.34.1, 0.35.0, and 0.35.1 are affected by CVE-2020-1932.
How can I fix CVE-2020-1932?
To fix CVE-2020-1932, upgrade Apache Superset to version 0.35.2 or higher.
What is the Common Weakness Enumeration (CWE) ID for CVE-2020-1932?
The CWE ID for CVE-2020-1932 is CWE-200.