Vulnerabilityhigh

Alert: Apache Superset Vulnerabilities Expose Servers to Remote Code Execution Attacks

The Hacker Newsby @TheHackersNewsSep 8, 2023 · 02:46 UTC (Sep 8, 2023)3 min read5

Read at thehackernews.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2023-39265 CVE-2023-37941 CVE-2023-36388 CVE-2023-30776 CVE-2023-27524

Tags: cve-2023-39265 cve-2023-37941 cve-2023-36388 cve-2023-30776 cve-2023-27524 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2023-27524 +1 related CVE CVE-2023-30776	Insecure default SECRET_KEY in Apache Superset enables auth bypass and RCE	9.8 group max	98%	KEVPoC ×2	Apr 24, 2023 KEV Jan 8, 2024
CVE-2023-39265 +2 related CVEs CVE-2023-37941 CVE-2023-36388	Apache Superset would allow for SQLite database connections to be incorrectly registered when an attacker uses alternative driver names like sqlite+pysqlite or…	6.5 group max	86%		Sep 6, 2023

From the original article

3 min read at thehackernews.com

 Ravie Lakshmanan  Sep 07, 2023 Server Security / Vulnerability Patches have been released to address two new security vulnerabilities in Apache Superset that could be exploited by an attacker to gain remote code execution on affected systems. The update (version 2. 1.

The Hacker News

By @TheHackersNews · thehackernews.com

Read the full article at The Hacker News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.