What is GHSA-cpvx-2365-466c?

GHSA-cpvx-2365-466c is a security advisory published by GitHub Security Advisories with Medium severity. Apache Superset may expose internal traces on REST API endpoints

Which CVE IDs does GHSA-cpvx-2365-466c cover?

GHSA-cpvx-2365-466c covers the following CVE IDs: CVE-2023-39264. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-cpvx-2365-466c?

GHSA-cpvx-2365-466c has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

Which products are affected by GHSA-cpvx-2365-466c?

GHSA-cpvx-2365-466c affects 1 product, including: pip/apache-superset:\u003c= 2.1.0.

GHSA-cpvx-2365-466cMediumCVSS 4.3

Apache Superset may expose internal traces on REST API endpoints

Vendor

GitHub Security Advisories

Published

September 6, 2023

Last Modified

November 7, 2023

🔗 CVE IDs covered (1)

CVE-2023-39264 →

📋 Description

By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vulnerability exists in Apache Superset versions up to and including 2.1.0.

🎯 Affected products1

pip/apache-superset:<= 2.1.0

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2023-39264
https://lists.apache.org/thread/y65t1of7hb445n86o1vdzjct7rfwlx75
https://github.com/advisories/GHSA-cpvx-2365-466c