CVE-2023-36387

An improper default REST API permission for Gamma users in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma user to test database connections.

Score

CVSS 3.1 5.4 Medium

Status

Modified - security@apache.org

Published

2023-09-06

Last modified

2024-09-26

Weaknesses

CWE-863

Affected products

• Superset (Apache)
• Apache Superset (Apache Software Foundation)

References

• https://github.com/apache/superset/pull/24185
• https://lists.apache.org/thread/tt6s6hm8nv6s11z8bfsk3r3d9ov0ogw3