CVE-2022-41703: Apache Superset: SQL injection vulnerability in adhoc clauses
A vulnerability in the SQL Alchemy connector of Apache Superset allows an authenticated user with read access to a specific database to add subqueries to the WHERE and HAVING fields referencing tables on the same database that the user should not have access to, despite the user having the feature flag "ALLOWADHOCSUBQUERY" disabled (default value). This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-41703?
CVE-2022-41703 is a vulnerability in the SQL Alchemy connector of Apache Superset that allows an authenticated user with read access to a specific database to add subqueries to the WHERE and HAVING fields referencing tables on the same database that the user should not have access to.
What is the affected software?
The affected software is Apache Superset version 1.5.2, 2.0.0, 2.0.0-rc1, and 2.0.0-rc2.
What is the severity of CVE-2022-41703?
The severity of CVE-2022-41703 is medium with a CVSS score of 5.4.
How can I fix the vulnerability?
To fix the vulnerability, upgrade Apache Superset to a version that is not affected, such as version 1.5.3 or later.
Where can I find more information about CVE-2022-41703?
You can find more information about CVE-2022-41703 at the following link: https://lists.apache.org/thread/g7jjw0okxjk5y57pbbxy19ydw42kqcos