CVE-2021-37839

CVE-2021-37839: Improper access to dataset metadata information

Vendor Apache Software Foundation

Product Apache Superset

Weakness CWE-273

Published July 6, 2022

Last update August 4, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Apache Superset up to 1.5.1 allowed for authenticated users to access metadata information related to datasets they have no permission on. This metadata included the dataset name, columns and metrics.

Key dates

02Disclosure timeline

July 6, 2022 CVE published

August 4, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2021-37839 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/273.html

Related vulnerabilities

04Related CVE

CVE-2025-1003 HP Anyware Agent for Linux – Potential Authentication Bypass CVE-2026-44073 seteuid failure ignored in auth modules CVE-2026-32107 xrdp: Fail-open privilege drop in sesexec — child processes may execute as root if setuid fails CVE-2026-21882 theshit's Improper Privilege Dropping Allows Local Privilege Escalation via Command Re-execution CVE-2023-0657 Keycloak: impersonation via logout token exchange