CVE-2024-24779: 
Wolfi vulnerability analysis and mitigation

Apache Superset, prior to versions 3.0.4 and 3.1.1, contained a vulnerability related to improper data authorization when creating new datasets. The issue was discovered and disclosed on February 28, 2024, affecting Apache Superset installations before version 3.0.4 and from version 3.1.0 before 3.1.1 (Apache List, NVD).

The vulnerability exists in Apache Superset's role-based access control system. Specifically, users with custom roles that include 'can write on dataset' permissions but without all data access permissions could potentially bypass intended access restrictions. This security flaw allows affected users to create virtual datasets to access data they shouldn't have permission to view (Openwall).

The vulnerability enables unauthorized access to data through the creation of virtual datasets. Users with specific custom role configurations could potentially access and view data that should be restricted from their access level (Openwall).

The vulnerability can be exploited by users who have custom roles with 'can write on dataset' permissions but lack full data access permissions. These users could create virtual datasets to gain unauthorized access to restricted data (Openwall).

Users are strongly recommended to upgrade to either version 3.1.1 or 3.0.4, which contain fixes for this vulnerability. These versions implement proper authorization checks when creating new datasets (NVD, Openwall).