https://seclists.org/oss-sec/2024/q2/293: CVE-2024-34693: Apache Superset: Server arbitrary file ad
Published Jun 20, 2024
·Updated
Affected Software
1 affected component
Apache Superset<3.1.3, <4.0.1
Frequently Asked Questions
1
What is the severity of CVE-2024-34693?
CVE-2024-34693 is rated as a high severity vulnerability due to its potential for unauthorized file access.
2
How do I fix CVE-2024-34693?
To mitigate CVE-2024-34693, upgrade Apache Superset to version 3.1.3 or 4.0.1 or later.
3
Who is affected by CVE-2024-34693?
All users of Apache Superset versions prior to 3.1.3 and 4.0.0 before 4.0.1 are affected by CVE-2024-34693.
4
What kind of attack can exploit CVE-2024-34693?
CVE-2024-34693 can be exploited by an authenticated attacker to create a MariaDB connection that enables local file access.
5
Is local_infile enabled by default in MariaDB for CVE-2024-34693?
No, local_infile is off by default in MariaDB, but if enabled, it exposes systems to CVE-2024-34693.