CVE-2022-41703

 

Published at: - 16-01-2023 12:15

Last modified: - 24-01-2023 04:45

Total changes: - 3

Description

A vulnerability in the SQL Alchemy connector of Apache Superset allows an authenticated user with read access to a specific database to add subqueries to the WHERE and HAVING fields referencing tables on the same database that the user should not have access to, despite the user having the feature flag "ALLOW_ADHOC_SUBQUERY" disabled (default value). This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

 

Verification logic

 

Reference

• https://lists.apache.org/thread/g7jjw0okxjk5y57pbbxy19ydw42kqcos

 

Keywords

NVD

 

CVE-2022-41703

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures