CVE-2023-36388

—

CVSS 3.1

5.4 medium

EPSS

1%p64

Published

Sep 6, 2023 (Sep 6, 2023)

Modified

Jun 17, 2026

Description

Improper REST API permission in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma users to test network connections, possible SSRF.

Vendors: apache
Products: superset
Weakness: CWE-918
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (1.1%)

In the news1 stories

Alert: Apache Superset Vulnerabilities Expose Servers to Remote Code Execution Attacks

The Hacker NewsSep 8, 02:46 UTC · Sep 8, 2023Vulnerability CVE-2023-39265 CVE-2023-37941 CVE-2023-36388+2 CVEs