CVE-2024-28148: 
Wolfi vulnerability analysis and mitigation

An authenticated user could potentially access metadata for a datasource they are not authorized to view by submitting a targeted REST API request. This vulnerability (CVE-2024-28148) affects Apache Superset versions before 3.1.2. The vulnerability was discovered and disclosed on May 7, 2024 (Apache Mailing List).

The vulnerability is classified as an Incorrect Authorization issue (CWE-863) with a CVSS v3.1 Base Score of 4.3 (MEDIUM) and vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. This indicates that the vulnerability requires network access, low attack complexity, requires low privileges, needs no user interaction, has unchanged scope, and can result in low confidentiality impact with no impact on integrity or availability (NVD).

The vulnerability allows authenticated users to access metadata for datasources they should not have permission to view. This represents a confidentiality breach as unauthorized users could potentially gain insights into datasource configurations and structures they shouldn't have access to (NVD).

The vulnerability can be exploited by an authenticated user with low privileges by submitting specifically crafted REST API requests to access unauthorized datasource metadata (NVD).

Users are recommended to upgrade to Apache Superset version 3.1.2 or above, which contains the fix for this vulnerability (Apache Mailing List).