What is GHSA-fxjm-wvj9-9c39?

GHSA-fxjm-wvj9-9c39 is a security advisory published by GitHub Security Advisories with Medium severity. Information disclosure in Apache Superset

Which CVE IDs does GHSA-fxjm-wvj9-9c39 cover?

GHSA-fxjm-wvj9-9c39 covers the following CVE IDs: CVE-2020-1932. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-fxjm-wvj9-9c39?

GHSA-fxjm-wvj9-9c39 has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-fxjm-wvj9-9c39?

GHSA-fxjm-wvj9-9c39 affects 1 product, including: pip/apache-superset:\u003e= 0.34.0, \u003c 0.35.2.

GHSA-fxjm-wvj9-9c39MediumCVSS 6.5

Information disclosure in Apache Superset

Vendor

GitHub Security Advisories

Published

February 26, 2020

Last Modified

September 5, 2024

🔗 CVE IDs covered (1)

CVE-2020-1932 →

📋 Description

An information disclosure issue was found in Apache Superset 0.34.0, 0.34.1, 0.35.0, and 0.35.1. Authenticated Apache Superset users are able to retrieve other users' information, including hashed passwords, by accessing an unused and undocumented API endpoint on Apache Superset.

🎯 Affected products1

pip/apache-superset:>= 0.34.0, < 0.35.2

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2020-1932
https://lists.apache.org/thread.html/r4e5323c3bc786005495311a6ff53ac6d990b2c7eb52941a1a13ce227%40%3Cdev.superset.apache.org%3E
https://github.com/pypa/advisory-database/tree/main/vulns/apache-superset/PYSEC-2020-224.yaml
https://github.com/advisories/GHSA-fxjm-wvj9-9c39