CVE-2024-24773 MEDIUM

CVE-2024-24773: Apache Superset: Improper validation of SQL statements allows for unauthorized access to data

Vendor Apache Software Foundation
Product Apache Superset
Weakness CWE-863 · Incorrect authorization
Published February 28, 2024
Last update February 13, 2025
View on NVD All CVEs

CVSS base score

4.9/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

Description

Improper parsing of nested SQL statements on SQLLab would allow authenticated users to surpass their data authorization scope. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1, which fixes the issue.

Key dates

Disclosure timeline

February 28, 2024 CVE published
February 13, 2025 Record updated