by Kastro
Paper/Archive/CVE-2022-27479

CVE-2022-27479

Apache Software Foundation Apache Superset — SQL injection vulnerability in chart data API

EPSS 3%CVSS 9.8
critical.is priorityof 100
47
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 87.0.870 × 2017.4No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Apache Superset before 1.4.2 is vulnerable to SQL injection in chart data requests. Users should update to 1.4.2 or higher which addresses this issue.

Affected

ProductAffectedFixed inSource
Apache Supersetunspecified – < 1.4.21.4.2CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

reflists.apache.org/thread/94th50j5d0y2fw7ysx0g7w3t6jk3z7q6reflists.apache.org/thread/ztb9b6jd9rngoxwvq8r4fhpp401o613yrefopenwall.com/lists/oss-security/2022/04/13/3