CVE-2024-39887: 
Wolfi vulnerability analysis and mitigation

An SQL Injection vulnerability (CVE-2024-39887) was discovered in Apache Superset versions before 4.0.2. The vulnerability exists due to improper neutralization of special elements used in SQL commands, where certain engine-specific functions are not properly checked, allowing attackers to bypass Apache Superset's SQL authorization (OSS Security).

The vulnerability stems from the improper validation of PostgreSQL-specific functions, which could be exploited to bypass SQL authorization mechanisms. The affected PostgreSQL functions include version, query_to_xml, inet_server_addr, and inet_client_addr. The vulnerability has received a CVSS v3.1 base score of 9.8 (CRITICAL) from NIST and 4.3 (MEDIUM) from Apache Software Foundation, with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD Database).

The vulnerability could allow attackers to bypass Apache Superset's SQL authorization mechanisms, potentially leading to unauthorized access to database information and manipulation of SQL commands (NVD Database).

The vulnerability requires network access and has low attack complexity. No user interaction is required for exploitation, making it relatively straightforward to exploit for attackers with network access to the target system (NVD Database).

Users are recommended to upgrade to Apache Superset version 4.0.2 or later, which includes fixes for this vulnerability. Additionally, a new configuration key named DISALLOWED_SQL_FUNCTIONS has been introduced to disallow the use of specific PostgreSQL functions (OSS Security).