{"id":"CVE-2023-39265","published":"2023-09-06T13:00:11Z","modified":"2025-02-13T17:02:41Z","title":"Apache Superset: Possible Unauthorized Registration of SQLite Database Connections","vendor":"Apache Software Foundation","product":"Apache Superset","tier":"core","eol":null,"affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache Superset","versions":["<= 2.1.0"]}],"description":{"text":"Apache Superset would allow for SQLite database connections to be incorrectly registered when an attacker uses alternative driver names like sqlite+pysqlite or by using database imports. This could allow for unexpected file creation on Superset webservers. Additionally, if Apache Superset is using a SQLite database for its metadata (not advised for production use) it could result in more severe vulnerabilities related to confidentiality and integrity. This vulnerability exists in Apache Superset versions up to and including 2.1.0.","provenance":"source","from":"CVE.org"},"summary":{"text":"Apache Superset (Apache Software Foundation) fails to properly validate SQLite database connections, so connections can be incorrectly registered when alternative driver names such as sqlite+pysqlite are used or when databases are imported, which can cause unexpected file creation on Superset web servers. An attacker with high-privilege authenticated access, reachable over the network with low complexity and no user interaction, can exploit this, and the impact is more severe if Superset's metadata is stored in SQLite.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:13:48Z"},"cvss":{"score":3.8,"severity":"LOW","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.86032,"percentile":0.99729,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2025-08-12","exploitedFirstSeen":"2025-08-12","ransomware":false,"evidence":[{"url":"https://8813571.fs1.hubspotusercontent-na1.net/hubfs/8813571/PERISCOPE_VULNINTEL_20250812.pdf","date":"2025-08-12"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"}],"references":[{"url":"https://lists.apache.org/thread/pwdzsdmv4g5g1n2h9m7ortfnxmhr7nfy","tags":["vendor-advisory"]},{"url":"http://packetstormsecurity.com/files/175094/Apache-Superset-2.0.0-Remote-Code-Execution.html","tags":[]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"PyPI","package":"apache-superset","vulnerableRanges":["<=2.1.0","<2.1.1"],"patched":["2.1.1"],"from":["GHSA-fm4q-j8g4-c9j4","PYSEC-2026-1177"],"provenance":"source"}],"advisories":[{"id":"GHSA-fm4q-j8g4-c9j4","url":"https://github.com/advisories/GHSA-fm4q-j8g4-c9j4","severity":"MODERATE","ecosystem":"PyPI","package":"apache-superset","vulnerableRanges":["<=2.1.0"],"patched":[],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2023-2494","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-2494","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"metasploit":[{"name":"Apache Superset Signed Cookie RCE","module":"exploit/linux/http/apache_superset_cookie_sig_rce","type":"exploit","disclosureDate":"2023-09-06","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/apache_superset_cookie_sig_rce.rb"}],"first":{"date":"2023-09-06","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/apache_superset_cookie_sig_rce.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/175094/Apache-Superset-2.0.0-Remote-Code-Execution.html"],"flow":[],"timeline":[{"date":"2023-09-06","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2023-39265","provenance":"source"},{"date":"2023-09-06","kind":"exploit-public","label":"First public exploit: Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/apache_superset_cookie_sig_rce.rb","provenance":"source"},{"date":"2025-08-12","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://8813571.fs1.hubspotusercontent-na1.net/hubfs/8813571/PERISCOPE_VULNINTEL_20250812.pdf","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":62.6,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 443 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.95,"detail":"percentile 0.9973"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD exploit link; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":2.66,"detail":"base score 3.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}