CVE-2021-44451

MEDIUM NUCLEI

Apache Superset < 1.3.2 - Insufficiently Protected Credentials

Title source: rule

Description

Apache Superset up to and including 1.3.2 allowed for registered database connections password leak for authenticated users. This information could be accessed in a non-trivial way. Users should upgrade to Apache Superset 1.4.0 or higher.

Nuclei Templates (1)

Apache Superset <=1.3.2 - Default Login

MEDIUMVERIFIEDby dhiyaneshDK

Shodan: http.favicon.hash:1582430156 || http.html:"apache superset"

FOFA: body="apache superset" || icon_hash=1582430156

References (1)

[Mailing List, Vendor Advisory] https://lists.apache.org/thread/xww1pccs2ckb5506wrf1v4lmxg198vkb

Scores

CVSS v3 6.5

EPSS 0.7534

EPSS Percentile 98.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Classification

CWE

CWE-522

Status published

Affected Products (2)

apache/superset < 1.3.2

pypi/apache-superset < 1.4.0PyPI

Timeline

Published Feb 01, 2022

Tracked Since Feb 18, 2026