CVE-2022-41703
Published: Jan 16, 2023
Modified: Apr 8, 2025
Description
A vulnerability in the SQL Alchemy connector of Apache Superset allows an authenticated user with read access to a specific database to add subqueries to the WHERE and HAVING fields referencing tables on the same database that the user should not have access to, despite the user having the feature flag "ALLOW_ADHOC_SUBQUERY" disabled (default value). This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.
| Vendor | Product | Versions |
|---|---|---|
Apache Software Foundation | Apache Superset | affected 2.0.0 - < 2.0.1affected 0 - <= 1.5.2 |
References
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now