Duplicate Advisory: Apache Superset uncontrolled resource consumption

TRUNG BÌNH 6.5CVE-2024-23952 · GHSA-v7q3-5rqm-x7m9 · Công bố 14/02/2024 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2024-23952 là lỗ hổng mức TRUNG BÌNH (CVSS 6.5) ảnh hưởng apache-superset, superset (apache).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 1.7%, cao hơn 77.2% các lỗ hổng khác.
Cách xử lý: cập nhật lên 3.0.1, 2.1.2, 3.0.2, 2.1.3 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
apache-superset PyPI	`≥ 3.0.0, < 3.0.1< 2.1.2`	`3.0.12.1.2`
superset apache	`≥ 3.0.0, < 3.0.2< 2.1.3`	`3.0.22.1.3`

Mô tả

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of CVE-2023-46104. This link is maintained to preserve external references.

Original Description

With correct CVE version ranges for affected Apache Superset.

Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets. This vulnerability exists in Apache Superset versions up to and including 2.1.2 and versions 3.0.0, 3.0.1.

Mô tả của NVD

This is a duplicate for CVE-2023-46104. With correct CVE version ranges for affected Apache Superset. Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets. This vulnerability exists in Apache Superset versions up to and including 2.1.2 and versions 3.0.0, 3.0.1.