CVE-2023-42505 MEDIUM

CVE-2023-42505: Apache Superset: Sensitive information disclosure on db connection details

Vendor Apache Software Foundation

Product Apache Superset

Weakness CWE-200 · Info exposure

Published November 28, 2023

Last update February 13, 2025

View on NVD All CVEs

CVSS base score

4.3/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality Low

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

An authenticated user with read permissions on database connections metadata could potentially access sensitive information such as the connection's username. This issue affects Apache Superset before 3.0.0.

Key dates

02Disclosure timeline

November 28, 2023 CVE published

February 13, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-42505 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/200.html AskarLabs — CWE-200 write-up Exposure of Sensitive Information to an Unauthorized Actor

Related vulnerabilities

04Related CVE

CVE-2026-4020 Gravity SMTP <= 2.1.4 - Unauthenticated Sensitive Information Exposure via REST API CVE-2025-15482 Chapa Payment Gateway Plugin for WooCommerce <= 1.0.3 - Unauthenticated Sensitive Information Exposure CVE-2026-16773 WPBot <= 8.5.9 - Unauthenticated Sensitive Information Exposure in 'wpbot_send_email_transcript' AJAX Action CVE-2026-8995 Poll Maker by AYS <= 6.3.7 - Authenticated (Subscriber+) Sensitive Information Exposure in 'ays_poll_get_user_information' AJAX Action CVE-2026-64874 Joomla Extension - regularlabs.com - CDN Credential leakage Cache Cleaner Pro extension