Apache Software Foundation · Apache Superset
Apache Superset (Apache Software Foundation) fails to properly validate SQLite database connections, so connections can be incorrectly registered when alternative driver names such as sqlite+pysqlite are used or when databases are imported, which can cause unexpected file creation on Superset web servers. An attacker with high-privilege authenticated access, reachable over the network with low complexity and no user interaction, can exploit this, and the impact is more severe if Superset's metadata is stored in SQLite.
Apache Superset would allow for SQLite database connections to be incorrectly registered when an attacker uses alternative driver names like sqlite+pysqlite or by using database imports. This could allow for unexpected file creation on Superset webservers. Additionally, if Apache Superset is using a SQLite database for its metadata (not advised for production use) it could result in more severe vulnerabilities related to confidentiality and integrity. This vulnerability exists in Apache Superset versions up to and including 2.1.0.
First seen exploited 23 months after disclosure. Public exploit code (Metasploit) was available the same day.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
1 package in 1 ecosystem. Main package: apache-superset.
Upgrade to 2.1.1 or later
Fixes this CVE and 4 other known vulnerabilities in this package (CVE-2021-27907, CVE-2021-28125, +2).
pip install "apache-superset>=2.1.1"The first fix for CVE-2023-39265.
| If you run | Upgrade to |
|---|---|
| All versions before 2.1.1 | 2.1.1 |
| 2.1.0 and earlier | No fix published |
“Up to” means the second version is the fix and is not affected.