[<prev] [next>] [day] [month] [year] [list]
Message-ID: <7fa9f1ae-bc15-c710-3ffa-21fbdb46f222@apache.org>
Date: Thu, 14 Aug 2025 11:33:43 +0000
From: Daniel Gaspar <dpgaspar@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2025-55673: Apache Superset: Metadata exposure in embedded
charts
Severity:
Affected versions:
- Apache Superset before 4.1.3
Description:
When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user.
This issue affects Apache Superset: before 4.1.3.
Users are recommended to upgrade to version 4.1.3, which fixes the issue.
Credit:
Pedro Sousa (coordinator)
Daniel Gaspar (remediation developer)
References:
https://www.cve.org/CVERecord?id=CVE-2025-55673
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
