
Cloud Vulnerability DB
A community-led vulnerabilities database
An SQL Injection vulnerability (CVE-2024-39887) was discovered in Apache Superset versions before 4.0.2. The vulnerability exists due to improper neutralization of special elements used in SQL commands, where certain engine-specific functions are not properly checked, allowing attackers to bypass Apache Superset's SQL authorization (OSS Security).
The vulnerability stems from the improper validation of PostgreSQL-specific functions, which could be exploited to bypass SQL authorization mechanisms. The affected PostgreSQL functions include version, query_to_xml, inet_server_addr, and inet_client_addr. The vulnerability has received a CVSS v3.1 base score of 9.8 (CRITICAL) from NIST and 4.3 (MEDIUM) from Apache Software Foundation, with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD Database).
The vulnerability could allow attackers to bypass Apache Superset's SQL authorization mechanisms, potentially leading to unauthorized access to database information and manipulation of SQL commands (NVD Database).
The vulnerability requires network access and has low attack complexity. No user interaction is required for exploitation, making it relatively straightforward to exploit for attackers with network access to the target system (NVD Database).
Users are recommended to upgrade to Apache Superset version 4.0.2 or later, which includes fixes for this vulnerability. Additionally, a new configuration key named DISALLOWED_SQL_FUNCTIONS has been introduced to disallow the use of specific PostgreSQL functions (OSS Security).
Source: This report was generated using AI
Free Vulnerability Assessment
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
"We know that if Wiz identifies something as critical, it actually is."