Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-41703

A vulnerability in the SQL Alchemy connector of Apache Superset allows an authenticated user with read access to a specific database to add subqueries to the WHERE and HAVING fields referencing tables on the same database that the user should not have access to, despite the user having the feature flag "ALLOW_ADHOC_SUBQUERY" disabled (default value). This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

Published

2023-01-16T11:15:10.303

Last Modified

2025-04-08T21:15:44.640

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 5.4 (MEDIUM)

Weaknesses
  • Type: Primary
    CWE-89
  • Type: Secondary
    CWE-89
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application apache superset ≤ 1.5.2 Yes
Application apache superset 2.0.0 Yes
Application apache superset 2.0.0 Yes
Application apache superset 2.0.0 Yes
References