CVE-2024-24773

MEDIUM

Apache Superset <3.0.4, >3.1.0-<3.1.1 - SQL Injection

Title source: llm

Description

Improper parsing of nested SQL statements on SQLLab would allow authenticated users to surpass their data authorization scope. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1, which fixes the issue.

References (2)

Core 2

Core References

Mailing List, Third Party Advisory

http://www.openwall.com/lists/oss-security/2024/02/28/4

Mailing List, Vendor Advisory vendor-advisory

https://lists.apache.org/thread/h66fy6nj41cfx07zh7l552w6dmtjh501

Scores

CVSS v3 4.9

EPSS 0.0015

EPSS Percentile 35.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-863

Status published

Products (2)

apache/superset < 3.0.4

pypi/apache-superset 0 - 3.0.4PyPI

Published Feb 28, 2024

Tracked Since Feb 18, 2026