[<prev] [next>] [day] [month] [year] [list]
Message-ID: <89e1b57e-ac38-b475-49f5-a7ca921731e6@apache.org>
Date: Fri, 30 May 2025 08:17:51 +0000
From: Daniel Gaspar <dpgaspar@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2025-48912: Apache Superset: Improper authorization bypass on
row level security via SQL Injection
Affected versions:
- Apache Superset before 4.1.2
Description:
An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields. This allowed the execution of sub-queries to evade parsing defenses ultimately granting unauthorized access to data.
This issue affects Apache Superset: before 4.1.2.
Users are recommended to upgrade to version 4.1.2, which fixes the issue.
Credit:
Pedro Sousa (coordinator)
Beto de Almeida (remediation developer)
Mirakl Security (finder)
References:
https://superset.apache.org
https://www.cve.org/CVERecord?id=CVE-2025-48912
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
