CVE-2023-49736: Apache Superset: SQL Injection on where_in JINJA macro
A wherein JINJA macro allows users to specify a quote, which combined with a carefully crafted statement would allow for SQL injection in Apache Superset.This issue affects Apache Superset: before 2.1.2, from 3.0.0 before 3.0.2.
Users are recommended to upgrade to version 3.0.2, which fixes the issue.
Other sources
A wherein JINJA macro allows users to specify a quote, which combined with a carefully crafted statement would allow for SQL injection in Apache Superset.This issue affects Apache Superset: before 2.1.3, from 3.0.0 before 3.0.2.
Users are recommended to upgrade to version 2.1.3 or 3.0.2, which fixes the issue.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-49736?
CVE-2023-49736 is classified as a critical vulnerability due to the potential for SQL injection attacks.
How do I fix CVE-2023-49736?
To remediate CVE-2023-49736, upgrade Apache Superset to version 3.0.2 or 2.1.3.
Which versions of Apache Superset are affected by CVE-2023-49736?
CVE-2023-49736 affects Apache Superset versions prior to 2.1.2 and versions from 3.0.0 up to 3.0.2.
What types of attacks can CVE-2023-49736 facilitate?
CVE-2023-49736 can facilitate SQL injection attacks, potentially allowing unauthorized access to database information.
Is there a workaround for CVE-2023-49736 if I can't upgrade?
There are no known workarounds for CVE-2023-49736, upgrading is the recommended action.