CVE-2023-37941

Advisory

Apache-superset 2.1.1 includes a fix for CVE-2023-37941: If an attacker gains write access to the Apache Superset metadata database, they could persist a specifically crafted Python object that may lead to remote code execution on Superset's web backend.
https://lists.apache.org/thread/6qk1zscc06yogxxfgz2bh2bvz6vh9g7h

Affected package

Affected versions

Fixed versions

Vulnerability changelog

If an attacker gains write access to the Apache Superset metadata database, they could persist a specifically crafted Python object that may lead to remote code execution on Superset's web backend. This vulnerability impacts Apache Superset versions 1.5.0 up to and including 2.1.0. See CVE-2023-37941.


MISC:https://lists.apache.org/thread/6qk1zscc06yogxxfgz2bh2bvz6vh9g7h: https://lists.apache.org/thread/6qk1zscc06yogxxfgz2bh2bvz6vh9g7h

Resources

• https://lists.apache.org/thread/6qk1zscc06yogxxfgz2bh2bvz6vh9g7h
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-37941
• http://packetstormsecurity.com/files/175094/Apache-Superset-2.0.0-Remote-Code-Execution.html