CVE-2023-30776: Apache Superset: Database connection password leak
Published Apr 24, 2023
·Updated
An authenticated user with specific data permissions could access database connections stored passwords by requesting a specific REST API. This issue affects Apache Superset version 1.3.0 up to 2.0.1.
Affected Software
1 affected component
Apache Superset>=1.3.0<=2.0.1
Event History
Apr 24, 2023
CVE Published
via MITRE·03:29 PM
Data Sourced
via MITRE·03:29 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is CVE-2023-30776?
CVE-2023-30776 is a vulnerability in Apache Superset that allows an authenticated user with specific data permissions to access the stored passwords of database connections.
2
Is CVE-2023-30776 a high severity vulnerability?
No, CVE-2023-30776 has a severity value of 6.5 which is considered medium.
3
How does CVE-2023-30776 affect Apache Superset?
CVE-2023-30776 affects Apache Superset versions 1.3.0 up to 2.0.1.
4
How can an attacker exploit CVE-2023-30776?
An attacker with specific data permissions can exploit CVE-2023-30776 by making a request to a specific REST API in Apache Superset.
5
Are there any fixes available for CVE-2023-30776?
Yes, upgrading to Apache Superset version 2.0.2 or higher will fix the vulnerability.