title: Possible SQL Injection when template processing is enabled
description: Apache Superset up to and including 1.3.0 when configured with ENABLE_TEMPLATE_PROCESSING on (disabled by default) allowed SQL injection when a malicious authenticated user sends an http request with a custom URL.
problem types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
affected:
{
product: Apache Superset
vendor: Apache Software Foundation
versions:
lessThan: 1.3.1, status: affected, version: Apache Superset, versionType: custom
}
metrics:
other: [
content: {'other': 'low'}
type: unknown
]
workarounds: Don't enable ENABLE_TEMPLATE_PROCESSING (disabled by default).
Or upgrade to Apache Superset 1.3.1