Aller au contenu
en Se connecter
6.8 Moyenne

CVE-2024-34693 Improper Input Validation vulnerability in Apache Superset, allows for an authenticated attacker to create a MariaDB…

Description

Improper Input Validation vulnerability in Apache Superset, allows for an authenticated attacker to create a MariaDB connection with local_infile enabled. If both the MariaDB server (off by default) and the local mysql client on the web server are set to allow for local infile, it's possible for the attacker to execute a specific MySQL/MariaDB SQL command that is able to read files from the server and insert their content on a MariaDB database table.This issue affects Apache Superset: before 3.1.3 and version 4.0.0 Users are recommended to upgrade to version 4.0.1 or 3.1.3, which fixes the issue.

Produits et versions touchés

Produit Versions touchées Corrigé en
Apache Superset 4.0 4.0.0 → < 4.0.1 4.0.1
Apache Superset 3.1 premières → < 3.1.3 3.1.3

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Apache Superset

Les 65 CVE de Apache Superset →
CVE-2026-23985 A Regular Expression Denial of Service (ReDoS) vulnerability exists in Apache Superset versions 1.5.0 through 5.0.0 5.3 Moyenne CVE-2026-23981 An Improper Authorization vulnerability exists in Apache Superset allowing an authenticated user with permissions to… 5.3 Moyenne CVE-2026-23969 Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execution of potentially… 5.3 Moyenne CVE-2026-23980 Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset… 5.3 Moyenne
Suivre cette CVE