Information disclosure in Apache Superset - CVE-2020-13952
Published: September 30, 2020
Vulnerability identifier: #VU47224
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2020-13952
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Apache Foundation
Affected software:
Apache Superset
Apache Superset
Detailed vulnerability description
The vulnerability allows a remote user to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application due to improper input validation within the Hive and Presto database engines. A remote user send a specially crafted request to the application and reveal database structure.
How to mitigate CVE-2020-13952
Install updates from vendor's website.