CVE-2023-36388: Apache Superset: Improper API permission for low privilege users allows for SSRF
Published Sep 6, 2023
·Updated
Improper REST API permission in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma users to test network connections, possible SSRF.
Affected Software
2 affected components
pip/apache-superset<=2.1.0
Apache Superset<=2.1.0
Event History
Sep 6, 2023
CVE Published
via MITRE·12:53 PM
Data Sourced
via MITRE·12:53 PM
DescriptionSeverityWeakness
Advisory Published
03:30 PM
Frequently Asked Questions
1
What is CVE-2023-36388?
CVE-2023-36388 is a vulnerability in Apache Superset that allows for an authenticated Gamma user to test network connections, potentially leading to SSRF.
2
What is the severity of CVE-2023-36388?
CVE-2023-36388 has a severity score of 5.4 which is considered medium.
3
How does CVE-2023-36388 affect Apache Superset?
CVE-2023-36388 affects Apache Superset versions up to and including 2.1.0.
4
What actions can an authenticated Gamma user with low privileges perform due to CVE-2023-36388?
An authenticated Gamma user with low privileges can test network connections and potentially conduct SSRF attacks due to CVE-2023-36388.
5
How can I fix CVE-2023-36388?
To fix CVE-2023-36388, it is recommended to upgrade to a version of Apache Superset that is not affected by the vulnerability.