| Package | Affected versions | Patched versions |
|---|---|---|
| apache-superset | ≥ 3.1.0, < 3.1.1< 3.0.4 | 3.1.13.0.4 |
| superset | ≥ 3.1.0, < 3.1.1< 3.0.4 | 3.1.13.0.4 |
A guest user could exploit a chart data REST API and send arbitrary SQL statements that on error could leak information from the underlying analytics database.This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1.
Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free