CVE-2023-46104: Apache Superset: Allows for uncontrolled resource consumption via a ZIP bomb
Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets. This vulnerability exists in Apache Superset versions up to and including 2.1.2 and versions 3.0.0, 3.0.1.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-46104?
CVE-2023-46104 has a high severity due to its potential for uncontrolled resource consumption by authenticated attackers.
How do I fix CVE-2023-46104?
To mitigate CVE-2023-46104, upgrade Apache Superset to version 3.1.0rc1 or 2.1.2.
Which software versions are affected by CVE-2023-46104?
CVE-2023-46104 affects Apache Superset versions up to and including 2.1.2 and versions 3.0.0 and 3.0.1.
What type of attack does CVE-2023-46104 enable?
CVE-2023-46104 allows authenticated attackers to exploit uncontrolled resource consumption by uploading a malicious ZIP file.
Is a specific configuration required to exploit CVE-2023-46104?
Exploitation of CVE-2023-46104 requires the attacker to be authenticated and able to use the import feature.