Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2022-45438
CVE-2022-45438:
Python vulnerability analysis and mitigation
Overview
When explicitly enabling the feature flag DASHBOARD_CACHE (disabled by default) in Apache Superset, a vulnerability allowed unauthenticated users to access dashboard configuration metadata through a REST API Get endpoint. This security issue affects Apache Superset version 1.5.2 and prior versions, as well as version 2.0.0 (CVE Details).
Technical details
The vulnerability is identified as CVE-2022-45438 and is classified as a low-severity information leak vulnerability. The issue specifically occurs when the DASHBOARD_CACHE feature flag is explicitly enabled, which is not the default configuration. The vulnerability allows unauthorized access to dashboard configuration metadata through a REST API Get endpoint (Security Online).
Impact
The vulnerability could lead to unauthorized access to dashboard configuration metadata, potentially exposing sensitive information about the system's dashboard configurations to unauthenticated users (CVE Details).
Mitigation and workarounds
The vulnerability has been patched in Apache Superset versions 1.5.3 and 2.0.1. Users are advised to upgrade to these or later versions to address the security issue. If immediate upgrading is not possible, ensuring the DASHBOARD_CACHE feature flag remains disabled (its default state) will prevent exploitation (Security Online).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management