CVE-2023-40610 Apache Superset: Privilege escalation with default examples database

What is CVE-2023-40610?

CVE-2023-40610 is a medium-severity vulnerability in Apache Superset, published on 27 Nov 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Improper authorization check and possible privilege escalation on Apache Superset up to but excluding 2.1.2. Using the default examples database connection that allows access to both the examples schema and Apache Superset's metadata database, an attacker using a specially crafted CTE SQL statement could change data on the metadata database. This weakness could result on tampering with the authentication/authorization data.

Weakness: CWE-863

Which versions are affected by CVE-2023-40610?

4 open source packages ship an affected version, including apache-superset and superset. It affects 1 product.

Products include Apache Superset.

How do I fix CVE-2023-40610?

Upgrade apache-superset to 2.1.2 or later.

Is CVE-2023-40610 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-40610 exists.

Other vulnerabilities in Apache Superset

• CVE-2023-27524 Apache Superset Insecure Default Initialization of Resource Exploited High 8.9
• CVE-2022-27479 SQL injection vulnerability in chart data API Critical 9.8
• CVE-2018-8021 Deserialization of Untrusted Data in superset Critical 9.8
• CVE-2023-49657 Apache Superset: Stored XSS in Dashboard Title and Chart Title Critical 9.6
• CVE-2022-43719 Apache Superset: Cross Site Request Forgery (CSRF) on accept, request access API High 8.8

All Apache Superset vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-superset-2023-40610, GHSA-f678-j579-4xf5, PYSEC-2026-1173.