What is GHSA-95ch-p3gw-23qg?

GHSA-95ch-p3gw-23qg is a security advisory published by GitHub Security Advisories with Medium severity. Apache Superset has incorrect authorization check

Which CVE IDs does GHSA-95ch-p3gw-23qg cover?

GHSA-95ch-p3gw-23qg covers the following CVE IDs: CVE-2023-32672. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-95ch-p3gw-23qg?

GHSA-95ch-p3gw-23qg has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

Which products are affected by GHSA-95ch-p3gw-23qg?

GHSA-95ch-p3gw-23qg affects 1 product, including: pip/apache-superset:\u003c= 2.1.0.

GHSA-95ch-p3gw-23qgMediumCVSS 4.3

Apache Superset has incorrect authorization check

Vendor

GitHub Security Advisories

Published

September 6, 2023

Last Modified

November 6, 2023

🔗 CVE IDs covered (1)

CVE-2023-32672 →

📋 Description

An Incorrect authorisation check in SQLLab in Apache Superset versions up to and including 2.1.0. This vulnerability allows an authenticated user to query tables that they do not have proper access to within Superset. The vulnerability can be exploited by leveraging a SQL parsing vulnerability.

🎯 Affected products1

pip/apache-superset:<= 2.1.0

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2023-32672
https://lists.apache.org/thread/ococ6nlj80f0okkwfwpjczy3q84j3wkp
https://github.com/advisories/GHSA-95ch-p3gw-23qg