Skip to content
fr Sign in
4.3 Medium

CVE-2024-27315 An authenticated user with privileges to create Alerts on Alerts & Reports has the capability to generate a specially…

Description

An authenticated user with privileges to create Alerts on Alerts & Reports has the capability to generate a specially crafted SQL statement that triggers an error on the database. This error is not properly handled by Apache Superset and may inadvertently surface in the error log of the Alert exposing possibly sensitive data. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue.

Affected products and versions

Product Affected versions Fixed in
Apache Superset 3.1 3.1.0 → < 3.1.1 3.1.1
Apache Superset 3.0 earliest → < 3.0.4 3.0.4

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Apache Superset

The 65 CVEs of Apache Superset →
CVE-2026-23985 A Regular Expression Denial of Service (ReDoS) vulnerability exists in Apache Superset versions 1.5.0 through 5.0.0 5.3 Medium CVE-2026-23981 An Improper Authorization vulnerability exists in Apache Superset allowing an authenticated user with permissions to… 5.3 Medium CVE-2026-23969 Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execution of potentially… 5.3 Medium CVE-2026-23980 Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset… 5.3 Medium
Track this CVE