CVE-2024-34693

Advisory

An Improper Input Validation vulnerability in Apache Superset allows an authenticated attacker to establish a MariaDB connection with the local_infile option enabled. If both the MariaDB server (which has this feature disabled by default) and the local MySQL client on the web server are configured to allow local infile, the attacker can execute a specific SQL command to read files from the server and insert their contents into a MariaDB database table.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-hcr7-cqwc-q5gq
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-34693