Apache Superset Server Side Request Forgery vulnerability

MÉDIO 5.4CVE-2023-36388 · BIT-superset-2023-36388 · GHSA-4fg9-5w46-xmrj · Published 06/09/2023 · updated 17/06/2026

Em resumo

CVE-2023-36388 é uma vulnerabilidade MÉDIO (CVSS 5.4) que afeta apache-superset, superset (apache).
Chance de exploração nos próximos 30 dias (EPSS): 1.1%, maior que 66.0% das vulnerabilidades.
Correção: atualize para 2.1.1 ou posterior.

Package	Affected versions	Patched versions
apache-superset PyPI	`≤ 2.1.0< 2.1.1`	`2.1.1`
superset apache	`≤ 2.1.0`	No fix yet

Description

Improper REST API permission in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma users to test network connections, possible SSRF.

NVD description

Improper REST API permission in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma users to test network connections, possible SSRF.

References

nvd.nist.gov/vuln/detail/CVE-2023-36388 · ADVISORY
apache/superset · PACKAGE
lists.apache.org/thread/ccmjjz4jp17yc2kcd18qshmdtf7qorfs · WEB
pypi.org/project/apache-superset · PACKAGE
GitHub Advisory GHSA-4fg9-5w46-xmrj · ADVISORY

Mais vulnerabilidades de apache-superset

Ver tudo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

apache-superset

PyPI

≤ 2.1.0< 2.1.1

2.1.1

superset

apache

≤ 2.1.0

No fix yet

Description

Improper REST API permission in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma users to test network connections, possible SSRF.

NVD description

Improper REST API permission in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma users to test network connections, possible SSRF.

Mais vulnerabilidades de apache-superset

Ver tudo →