CVE-2022-27479: Apache Superset SQL Injection Vulnerability in Chart Data Requests
Summary
CVE-2022-27479: SQL injection vulnerability in chart data API. Affects superset versions < 1.4.2. Fixed in 1.4.2. How to fix ↓
Also tracked for
- apache-superset · PyPI
- apache-superset · PyPI
- apache-superset · PyPI
The same CVE-2022-27479 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Superset is an open-source data visualization and exploration platform designed to help users create interactive dashboards and reports. It supports a wide range of data sources and provides a user-friendly interface for data analysis. However, prior to version 1.4.2, Superset was found to be vulnerable to SQL injection attacks, particularly in chart data requests, which could allow unauthorized access to sensitive data.
Vulnerability Detail
The vulnerability arises from improper handling of user input in chart data requests, allowing attackers to inject malicious SQL code. This can lead to unauthorized data exposure, data manipulation, and potentially full database compromise. The critical nature of this vulnerability is underscored by its CVSS score of 9.8, indicating a high risk to users who have not updated to the patched version.
How To Fix
Minimum fixed version
1.4.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the Superset application or implement input validation measures to sanitize user inputs in chart data requests until the update can be applied.
Conclusion
In summary, CVE-2022-27479 is a critical SQL injection vulnerability in Apache Superset that can lead to severe security risks. Users are strongly encouraged to update to version 1.4.2 or higher to mitigate this risk. Additionally, utilizing tools like Vulert can help in monitoring for such vulnerabilities in the future.
See every vulnerability recorded for superset →
FAQ
CVE-2022-27479 is a critical SQL injection vulnerability found in Apache Superset versions prior to 1.4.2, affecting chart data requests.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized access to sensitive data, data manipulation, and potential full database compromise.
Yes, the vulnerability is addressed in Apache Superset version 1.4.2 and higher. Users are advised to update to this version or later.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software using a manifest file like package-lock.json. It helps developers maintain secure applications.
Related vulnerabilities
Recent vulnerabilities recorded for superset.
