Apache Software Foundation · Apache Superset
If an attacker gains write access to the Apache Superset metadata database, they could persist a specifically crafted Python object that may lead to remote code execution on Superset's web backend. The Superset metadata db is an 'internal' component that is typically only accessible directly by the system administrator and the superset process itself. Gaining access to that database should be difficult and require significant privileges. This vulnerability impacts Apache Superset versions 1.5.0 up to and including 2.1.0. Users are recommended to upgrade to version 2.1.1 or later.
First seen exploited 23 months after disclosure. Public exploit code (PoC-in-GitHub) was available 4 months before disclosure.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
1 package in 1 ecosystem. Main package: apache-superset.
Upgrade to 2.1.1 or later
Fixes this CVE and 2 other known vulnerabilities in this package (CVE-2023-27524, CVE-2023-39265).
pip install "apache-superset>=2.1.1"The first fix for CVE-2023-37941.
| If you run | Upgrade to |
|---|---|
| 1.5.0 up to 2.1.1 | 2.1.1 |
“Up to” means the second version is the fix and is not affected.