CVE-2023-39265 Apache Superset: Possible Unauthorized Registration of SQLite Database Connections
Attackers can bypass restrictions to register unauthorized SQLite connections, potentially creating files or compromising metadata integrity.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-39265?
CVE-2023-39265 is a low-severity missing authorization vulnerability in Apache Superset, published on 6 Sep 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Apache Superset would allow for SQLite database connections to be incorrectly registered when an attacker uses alternative driver names like sqlite+pysqlite or by using database imports. This could allow for unexpected file creation on Superset webservers. Additionally, if Apache Superset is using a SQLite database for its metadata (not advised for production use) it could result in more severe vulnerabilities related to confidentiality and integrity. This vulnerability exists in Apache Superset versions up to and including 2.1.0.
Weakness: CWE-20
Which versions are affected by CVE-2023-39265?
4 open source packages ship an affected version, including apache-superset and superset. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
apache-superset PyPI | All versions to 2.1.0 | None |
apache-superset PyPI | All versions to 2.1.0 | None |
apache-superset PyPI | All versions | 2.1.1 |
superset Bitnami | All versions | 2.1.1 |
Products include Apache Superset.
How do I fix CVE-2023-39265?
Upgrade apache-superset to 2.1.1 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-39265 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-39265 exists.
Public exploit code: 1 Metasploit module.
Other vulnerabilities in Apache Superset
- CVE-2023-27524 Apache Superset Insecure Default Initialization of Resource
- CVE-2022-27479 SQL injection vulnerability in chart data API
- CVE-2018-8021 Deserialization of Untrusted Data in superset
- CVE-2023-49657 Apache Superset: Stored XSS in Dashboard Title and Chart Title
- CVE-2022-43719 Apache Superset: Cross Site Request Forgery (CSRF) on accept, request access API
Sources
Also known as BIT-superset-2023-39265, GHSA-fm4q-j8g4-c9j4, PYSEC-2026-1177.