CVE-2023-39264

MEDIUM

Apache Superset <= 2.1.0 - Sensitive Information Exposure via REST API Error Stack Traces

Title source: llm

Description

By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vulnerability exists in Apache Superset versions up to and including 2.1.0.

References (1)

Core 1

Core References

Mailing List vendor-advisory

https://lists.apache.org/thread/y65t1of7hb445n86o1vdzjct7rfwlx75

Scores

CVSS v3 4.3

EPSS 0.0081

EPSS Percentile 52.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-209

Status published

Products (2)

apache/superset < 2.1.0

pypi/apache-superset 0PyPI

Published Sep 06, 2023

Tracked Since Feb 18, 2026