En resumen
- CVE-2024-24772 es una vulnerabilidad MEDIO (CVSS 4.3) que afecta a apache-superset, superset (apache).
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.95%, mayor que el 61.3% de las vulnerabilidades.
- Solución: actualizar a 3.1.1, 3.0.4 o posterior.
| Package | Affected versions | Patched versions |
|---|
| apache-superset PyPI | ≥ 3.1.0, < 3.1.1< 3.0.4
| 3.1.13.0.4
|
| superset | ≥ 3.1.0, < 3.1.1< 3.0.4
| 3.1.13.0.4
|
Description
A guest user could exploit a chart data REST API and send arbitrary SQL statements that on error could leak information from the underlying analytics database.This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1.
Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue.
NVD description
A guest user could exploit a chart data REST API and send arbitrary SQL statements that on error could leak information from the underlying analytics database.This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1.
Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free