CVE-2024-55633

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-55633
Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML statement that is Incorrectly identified as a read-only query, enabling its execution. Non postgres analytics database connections and postgres analytics database connections set with a readonly user (advised) are not vulnerable.  This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://lists.apache.org/thread/bwmd17fcvljt9q4cgctp4v09zh3qs7fb Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2024/12/12/1 Mailing List Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:*
History

12 Feb 2025, 10:15

Type Values Removed Values Added
CWE CWE-285

11 Feb 2025, 15:28

Type Values Removed Values Added
Summary
  • (es) Vulnerabilidad de autorización incorrecta en Apache Superset. En bases de datos analíticas de Postgres, un atacante con acceso a SQLLab puede crear una declaración DML de SQL especialmente manipulada que se identifica incorrectamente como una consulta de solo lectura, lo que permite su ejecución. Las conexiones a bases de datos analíticas que no sean de Postgres y las conexiones a bases de datos analíticas de Postgres configuradas con un usuario de solo lectura (recomendado) no son vulnerables. Este problema afecta a Apache Superset: anterior a la versión 4.1.0. Se recomienda a los usuarios que actualicen a la versión 4.1.0, que soluciona el problema.
References () https://lists.apache.org/thread/bwmd17fcvljt9q4cgctp4v09zh3qs7fb - () https://lists.apache.org/thread/bwmd17fcvljt9q4cgctp4v09zh3qs7fb - Mailing List, Vendor Advisory
References () http://www.openwall.com/lists/oss-security/2024/12/12/1 - () http://www.openwall.com/lists/oss-security/2024/12/12/1 - Mailing List, Third Party Advisory
First Time Apache superset
Apache
CPE cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:*
CWE CWE-863
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5

12 Dec 2024, 18:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/12/12/1 -

12 Dec 2024, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-12-12 15:15

Updated : 2025-02-12 10:15

NVD link : CVE-2024-55633

Mitre link : CVE-2024-55633

CVE.ORG link : CVE-2024-55633

JSON object : View

Products Affected

apache

  • superset
CWE
CWE-863

Incorrect Authorization