What is GHSA-748r-5r8q-273m?

GHSA-748r-5r8q-273m is a security advisory published by GitHub Security Advisories with Medium severity. Apache Superset allows authenticated users to access metadata they have no permission to

Which CVE IDs does GHSA-748r-5r8q-273m cover?

GHSA-748r-5r8q-273m covers the following CVE IDs: CVE-2021-37839. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-748r-5r8q-273m?

GHSA-748r-5r8q-273m has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

Which products are affected by GHSA-748r-5r8q-273m?

GHSA-748r-5r8q-273m affects 1 product, including: pip/apache-superset:\u003c 1.5.1.

GHSA-748r-5r8q-273mMediumCVSS 4.3

Apache Superset allows authenticated users to access metadata they have no permission to

Vendor

GitHub Security Advisories

Published

July 7, 2022

Last Modified

September 5, 2023

🔗 CVE IDs covered (1)

CVE-2021-37839 →

📋 Description

Apache Superset up to 1.5.1 allowed for authenticated users to access metadata information related to datasets they have no permission on. This metadata included the dataset name, columns and metrics.

🎯 Affected products1

pip/apache-superset:< 1.5.1

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2021-37839
https://lists.apache.org/thread/pwqyxxmn5gh7cnw3qsp66v0lt4xojt82
https://github.com/apache/superset/commit/2bd89d1705347da5446902a3f65eb8d0a6353503
https://github.com/advisories/GHSA-748r-5r8q-273m