CVE-2024-23952 in Superset

Résumé

par MITRE • 14/02/2024

Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets.   This vulnerability exists in Apache Superset versions up to and including 2.1.2 and versions 3.0.0, 3.0.1.

Once again VulDB remains the best source for vulnerability data.

• Responsable: Apache Software Foundation
• Réserver: 16/10/2023
• Divulgation: 14/02/2024
• Modérer: accepté
• Entrée: VDB-248374
• CPE: prêt
• CWE: CWE-400 (confirmé)
• CVSS: 6.5 (CNA)
• EPSS: 0.01653
• KEV: non
• Activités: très faible

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2024-23952
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-23952
• CVE Details: https://www.cvedetails.com/cve/CVE-2024-23952/