CVE-2021-37839

Apache Superset up to 1.5.1 allowed for authenticated users to access metadata information related to datasets they have no permission on. This metadata included the dataset name, columns and metrics.

Score

CVSS 3.1 4.3 Medium

Status

Modified - security@apache.org

Published

2022-07-06

Last modified

2024-08-04

Weaknesses

CWE-273

Affected products

• Superset (Apache)
• Apache Superset (Apache Software Foundation)

References

• https://lists.apache.org/thread/pwqyxxmn5gh7cnw3qsp66v0lt4xojt82