Vulnerabilityhigh

Two flaws in Apache SuperSet allow to remotely hack servers

Security Affairsby @securityaffairsSep 7, 2023 · 13:34 UTC (Sep 7, 2023)2 min read1 · 1 read

Read at securityaffairs.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2023-39265 CVE-2023-37941 CVE-2023-30776 CVE-2023-27524

Tags: cve-2023-39265 cve-2023-37941 cve-2023-30776 cve-2023-27524 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2023-27524 +1 related CVE CVE-2023-30776	Insecure default SECRET_KEY in Apache Superset enables auth bypass and RCE	9.8 group max	98%	KEVPoC ×2	Apr 24, 2023 KEV Jan 8, 2024
CVE-2023-39265 +1 related CVE CVE-2023-37941	Apache Superset would allow for SQLite database connections to be incorrectly registered when an attacker uses alternative driver names like sqlite+pysqlite or…	6.5 group max	86%		Sep 6, 2023

From the original article

2 min read at securityaffairs.com

A couple of security vulnerabilities in Apache SuperSet could be exploited by an attacker to gain remote code execution on vulnerable systems. Apache Superset is an open-source Data Visualization and Data Exploration Platform, it is written in Python and based on the Flask web framework. Version 2.

Security Affairs

By @securityaffairs · securityaffairs.com

Read the full article at Security Affairs

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.