title: Apache Superset: Improper data permission validation on Jinja templated queries
description: Improper data authorization check on Jinja templated queries in Apache Superset up to and including 2.1.0 allows for an authenticated user to issue queries on database tables they may not have access to.
problem types: CWE-863 Incorrect Authorization
affected:
{
defaultStatus: unaffected
product: Apache Superset
vendor: Apache Software Foundation
versions:
lessThanOrEqual: 2.1.0, status: affected, version: 0, versionType: semver
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL