CVE-2023-42501: Apache Superset: Unnecessary read permissions within the Gamma role
Unnecessary read permissions within the Gamma role would allow authenticated users to read configured CSS templates and annotations. This issue affects Apache Superset: before 2.1.2. Users should upgrade to version or above 2.1.2 and run superset init to reconstruct the Gamma role or remove canread permission from the mentioned resources.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-42501.
What is the severity of CVE-2023-42501?
The severity of CVE-2023-42501 is medium with a severity value of 4.3.
Which version of Apache Superset is affected by CVE-2023-42501?
The versions of Apache Superset before 2.1.2 are affected by CVE-2023-42501.
How can I fix CVE-2023-42501?
To fix CVE-2023-42501, users should upgrade to version 2.1.2 or above and run 'superset init' to reconstruct the Gamma role or remove 'can_r...' permission.
Are there any references available for CVE-2023-42501?
Yes, you can find more information about CVE-2023-42501 at the following references: [Reference 1](https://lists.apache.org/thread/vk1rmrh9kz0chjmc9tk7o3md6zpz4ygh), [Reference 2](http://www.openwall.com/lists/oss-security/2023/11/27/3), [Reference 3](https://nvd.nist.gov/vuln/detail/CVE-2023-42501).