VULNERABILITY INTELLIGENCE

CVE-2023-49734

CVSS score7.7 HIGH

EPSS probability0.95%

CISA KEVNot currently listed

Published2023-12-19

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Description

An authenticated Gamma user has the ability to create a dashboard and add charts to it, this user would automatically become one of the owners of the charts allowing him to incorrectly have write permissions to these charts.This issue affects Apache Superset: before 2.1.2, from 3.0.0 before 3.0.2. Users are recommended to upgrade to version 3.0.2 or 2.1.3, which fixes the issue.

Weakness classification

security@apache.org: CWE-863

Primary references

security@apache.org — Mailing List, Third Party Advisory
security@apache.org — Mailing List, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Vendor Advisory