CVE-2024-24772: Apache Superset: Improper Neutralisation of custom SQL on embedded context
A guest user could exploit a chart data REST API and send arbitrary SQL statements that on error could leak information from the underlying analytics database.This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1.
Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-24772?
CVE-2024-24772 has been categorized with a high severity level due to the potential for unauthorized SQL injection exploits.
How do I fix CVE-2024-24772?
To fix CVE-2024-24772, upgrade your Apache Superset installation to version 3.1.1 or 3.0.4.
Which versions of Apache Superset are affected by CVE-2024-24772?
CVE-2024-24772 affects Apache Superset versions prior to 3.1.1 and from 3.0.3 and below.
Can a guest user exploit CVE-2024-24772?
Yes, CVE-2024-24772 can be exploited by a guest user through the chart data REST API to leak information.
What kind of information can be leaked due to CVE-2024-24772?
CVE-2024-24772 can potentially leak sensitive information from the underlying analytics database during SQL execution errors.