Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.3
CVE-2021-37839: Apache Superset: Authenticated users can see unauthorized dataset details
CVE-2021-37839 · published 4 years ago
Summary
Apache Superset versions up to 1.5.1 allow authenticated users to view sensitive information about datasets they shouldn't have access to. This includes the dataset name, columns, and metrics. To fix this, update to Apache Superset 1.5.2 or later.
What to do
- Update apache software foundation apache-superset to version 1.5.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| pip | apache software foundation | apache-superset |
< 1.5.1 Fix: upgrade to 1.5.1
|
| – | apache | superset |
<= 1.5.1 cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:* |
Original advisory text
Apache Superset up to 1.5.1 allowed for authenticated users to access metadata information related to datasets they have no permission on. This metadata included the dataset name, columns and metrics.
Apache Superset up to 1.5.1 allowed for authenticated users to access metadata information related to datasets they have no permission on. This metadata included the dataset name, columns and metrics.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-273Improper Check for Dropped Privileges
Timeline
Published6 Jul 2022
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta