CVE-2021-41972

MEDIUM

Apache Superset < 1.3.1 - Insufficiently Protected Credentials

Title source: rule

Description

Apache Superset up to and including 1.3.1 allowed for database connections password leak for authenticated users. This information could be accessed in a non-trivial way.

References (2)

Scores

CVSS v3 6.5
EPSS 0.0031
EPSS Percentile 54.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Classification

CWE
CWE-522
Status published

Affected Products (2)

apache/superset < 1.3.1
pypi/apache-superset < 1.3.2PyPI

Timeline

Published Nov 12, 2021
Tracked Since Feb 18, 2026