CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!
CVE-2024-24773: Apache Superset: Improper validation of SQL statements allows for unauthorized access to data
4.9
CVSS
Description
Improper parsing of nested SQL statements on SQLLab would allow authenticated users to surpass their data authorization scope.
This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1.
Users are recommended to upgrade to version 3.1.1, which fixes the issue.
Classification
CVE ID: CVE-2024-24773
CVSS Base Severity: MEDIUM
CVSS Base Score: 4.9
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Affected Products
Vendor: Apache Software Foundation
Product: Apache Superset
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.11% (probability of being exploited)
EPSS Percentile: 45.08% (scored less or equal to compared to others)
EPSS Date: 2025-03-14 (when was this score calculated)
References
https://lists.apache.org/thread/h66fy6nj41cfx07zh7l552w6dmtjh501http://www.openwall.com/lists/oss-security/2024/02/28/4