title: Apache Superset: Privilege Escalation Vulnerability
description: An authenticated Gamma user has the ability to create a dashboard and add charts to it, this user would automatically become one of the owners of the charts allowing him to incorrectly have write permissions to these charts.This issue affects Apache Superset: before 2.1.2, from 3.0.0 before 3.0.2.
Users are recommended to upgrade to version 3.0.2 or 2.1.3, which fixes the issue.
problem types: CWE-863 Incorrect Authorization
affected:
{
defaultStatus: unaffected
product: Apache Superset
vendor: Apache Software Foundation
versions:
lessThan: 2.1.2, status: affected, version: 0, versionType: semver
lessThan: 3.0.2, status: affected, version: 3.0.0, versionType: semver
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.7
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL