What is GHSA-wh73-hpcg-v32j?

GHSA-wh73-hpcg-v32j is a security advisory published by GitHub Security Advisories with Critical severity. SQL injection in apache-superset

Which CVE IDs does GHSA-wh73-hpcg-v32j cover?

GHSA-wh73-hpcg-v32j covers the following CVE IDs: CVE-2022-27479. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-wh73-hpcg-v32j?

GHSA-wh73-hpcg-v32j has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-wh73-hpcg-v32j?

GHSA-wh73-hpcg-v32j affects 1 product, including: pip/apache-superset:\u003c 1.4.2.

GHSA-wh73-hpcg-v32jCriticalCVSS 9.8

SQL injection in apache-superset

Vendor

GitHub Security Advisories

Published

April 14, 2022

Last Modified

August 31, 2023

🔗 CVE IDs covered (1)

CVE-2022-27479 →

📋 Description

Apache Superset before 1.4.2 is vulnerable to SQL injection in chart data requests. Users should update to 1.4.2 or higher which addresses this issue.

🎯 Affected products1

pip/apache-superset:< 1.4.2

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2022-27479
https://lists.apache.org/thread/94th50j5d0y2fw7ysx0g7w3t6jk3z7q6
https://lists.apache.org/thread/ztb9b6jd9rngoxwvq8r4fhpp401o613y
http://www.openwall.com/lists/oss-security/2022/04/13/3
https://github.com/pypa/advisory-database/tree/main/vulns/apache-superset/PYSEC-2022-188.yaml
https://github.com/advisories/GHSA-wh73-hpcg-v32j