Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2020-1932

An information disclosure issue was found in Apache Superset 0.34.0, 0.34.1, 0.35.0, and 0.35.1. Authenticated Apache Superset users are able to retrieve other users' information,

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
apache

Description

An information disclosure issue was found in Apache Superset 0.34.0, 0.34.1, 0.35.0, and 0.35.1. Authenticated Apache Superset users are able to retrieve other users' information, including hashed passwords, by accessing an unused and undocumented API endpoint on Apache Superset.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Apache Software Foundation Apache Superset

  • 0.34.0affected
  • 0.34.1affected
  • 0.35.0affected
  • 0.35.1affected

References