CVE-2021-41971: Possible SQL Injection when template processing is enabled
Published Oct 18, 2021
·Updated
Apache Superset up to and including 1.3.0 when configured with ENABLETEMPLATEPROCESSING on (disabled by default) allowed SQL injection when a malicious authenticated user sends an http request with a custom URL.
Affected Software
2 affected componentsFixes available
Apache Superset<=1.3.0
pip/apache-superset<=1.3.0
1.3.1
Event History
Oct 18, 2021
CVE Published
via MITRE·02:30 PM
Data Sourced
via MITRE·02:30 PM
DescriptionWeakness
Data Sourced
via NVD·03:15 PM
DescriptionSeverityWeaknessAffected Software
May 24, 2022
Advisory Published
via GitHub·07:17 PM
Frequently Asked Questions
1
What is CVE-2021-41971?
CVE-2021-41971 is a vulnerability in Apache Superset up to and including version 1.3.0 that allows SQL injection when a malicious authenticated user sends a custom URL.
2
What is the severity of CVE-2021-41971?
The severity of CVE-2021-41971 is high, with a CVSS score of 8.8.
3
Which software is affected by CVE-2021-41971?
Apache Superset up to and including version 1.3.0 is affected by CVE-2021-41971.
4
How can I fix CVE-2021-41971?
To fix CVE-2021-41971, upgrade to Apache Superset version 1.3.1.
5
What is the CWE ID for CVE-2021-41971?
The CWE ID for CVE-2021-41971 is 89, which represents Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection').