CVE-2024-53949: Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled
Improper Authorization vulnerability in Apache Superset when FABADDSECURITYAPI is enabled (disabled by default). Allows for lower privilege users to use this API.
issue affects Apache Superset: from 2.0.0 before 4.1.0.
Users are recommended to upgrade to version 4.1.0, which fixes the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-53949?
CVE-2024-53949 is considered a high severity vulnerability due to improper authorization allowing lower privilege users to access sensitive APIs.
How do I fix CVE-2024-53949?
To fix CVE-2024-53949, upgrade Apache Superset to version 4.1.0 or later.
What versions of Apache Superset are affected by CVE-2024-53949?
CVE-2024-53949 affects Apache Superset versions from 2.0.0 up to but not including 4.1.0.
What functionality is impacted by CVE-2024-53949?
CVE-2024-53949 allows lower privilege users to utilize the FAB_ADD_SECURITY_API, leading to potential unauthorized access.
Is FAB_ADD_SECURITY_API enabled by default in Apache Superset versions before 4.1.0?
No, FAB_ADD_SECURITY_API is disabled by default in Apache Superset versions, but it can still pose a risk if enabled.