CVE-2023-42505: Apache Superset: Sensitive information disclosure on db connection details
Published Nov 28, 2023
·Updated
An authenticated user with read permissions on database connections metadata could potentially access sensitive information such as the connection's username.
This issue affects Apache Superset before 3.0.0.
Affected Software
2 affected componentsFixes available
Apache Superset<3.0.0
pip/apache-superset<3.0.0
3.0.0
Event History
Nov 28, 2023
CVE Published
via MITRE·04:26 PM
Data Sourced
via MITRE·04:26 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·05:15 PM
DescriptionSeverityWeaknessAffected Software
Advisory Published
06:30 PM
Frequently Asked Questions
1
What is CVE-2023-42505?
CVE-2023-42505 is a vulnerability in Apache Superset that allows an authenticated user to access sensitive information, such as a database connection's username.
2
How does CVE-2023-42505 affect Apache Superset?
CVE-2023-42505 affects Apache Superset versions before 3.0.0.
3
What is the severity of CVE-2023-42505?
The severity of CVE-2023-42505 is medium, with a CVSS score of 4.3.
4
How can an attacker exploit CVE-2023-42505?
An attacker can exploit CVE-2023-42505 by being an authenticated user with read permissions on database connections metadata.
5
How can I fix CVE-2023-42505?
To fix CVE-2023-42505, update Apache Superset to version 3.0.0 or later.