CVE-2024-53948 MEDIUM

CVE-2024-53948: Apache Superset: Error verbosity exposes metadata in analytics databases

Vendor Apache Software Foundation

Product Apache Superset

Weakness CWE-209 · Error message info leak

Published December 9, 2024

Last update December 9, 2024

View on NVD All CVEs

CVSS base score

5.3/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N

What the vulnerability does

01Description

Generation of Error Message Containing analytics metadata Information in Apache Superset. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue.

Key dates

02Disclosure timeline

December 9, 2024 CVE published

December 9, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-53948 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/209.html AskarLabs — CWE-209 write-up Generation of Error Message Containing Sensitive Information

Related vulnerabilities

04Related CVE

CVE-2024-13539 AForms Eats <= 1.3.1 - Unauthenticated Full Path Disclosure CVE-2025-24552 WordPress Paytium plugin <= 4.4.11 - Full Path Disclosure (FPD) vulnerability CVE-2024-13538 BigBuy Dropshipping Connector for WooCommerce <= 2.0.0 - Unauthenticated Full Path Disclosute CVE-2024-13540 WooODT Lite – Delivery & pickup date time location for WooCommerce <= 2.5.1 - Unauthenticated Full Path Dsiclosure CVE-2024-50512 WordPress Posti Shipping plugin <= 3.10.2 - Full Path Disclosure (FPD) vulnerability