Permissions, Privileges, and Access Controls in Apache Superset - CVE-2022-41703
Published: January 17, 2023
Vulnerability identifier: #VU71201
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-41703
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to gain access to sensitive information.
The vulnerability exists due to improper access access restrictions within the SQL Alchemy connector. A remote user with with read access to a specific database can add subqueries to the WHERE and HAVING fields referencing tables on the same database that the user should not have access to, despite the user having the feature flag "ALLOW_ADHOC_SUBQUERY" disabled (default value).
Affected software
Apache Superset
How to mitigate CVE-2022-41703
Install updates from vendor's website.
Apache Superset - addressed in versions 1.5.3, 2.0.1