CVE - CVE-2023-40610

CVE-ID
CVE-2023-40610	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Improper authorization check and possible privilege escalation on Apache Superset up to but excluding 2.1.2. Using the default examples database connection that allows access to both the examples schema and Apache Superset's metadata database, an attacker using a specially crafted CTE SQL statement could change data on the metadata database. This weakness could result on tampering with the authentication/authorization data.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://github.com/orangecertcc/security-research/security/advisories/GHSA-f678-j579-4xf5 MISC:https://lists.apache.org/thread/jvgxpk4dbxyqtsgtl4pdgbd520rc0rot URL:https://lists.apache.org/thread/jvgxpk4dbxyqtsgtl4pdgbd520rc0rot MLIST:[oss-security] 20231127 CVE-2023-40610: Apache Superset: Privilege escalation with default examples database URL:http://www.openwall.com/lists/oss-security/2023/11/27/2
Assigning CNA
Apache Software Foundation
Date Record Created
20230817	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20230817)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)