CVE-2020-1932

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An information disclosure issue was found in Apache Superset 0.34.0, 0.34.1, 0.35.0, and 0.35.1. Authenticated Apache Superset users are able to retrieve other users' information, including hashed passwords, by accessing an unused and undocumented API endpoint on Apache Superset.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected software

No affected versions have been published.

Timeline

Published
Jan 28, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-193209.8Buffer overflow vulnerability in DLINK 619L version B 2.06beta via the curTime parameter on login.CVE-2020-193237.5An issue was discovered in /bin/mini_upnpd on D-Link DIR-619L 2.06beta devices. There is a heap buffer overflow allowing remote attackers toCVE-2020-19336.1A XSS vulnerability was found in Apache NiFi 1.0.0 to 1.10.0. Malicious scripts could be injected to the UI through action by an unaware autCVE-2020-19345.3In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server.CVE-2020-19354.8In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsinCVE-2020-19366.1A cross-site scripting issue was found in Apache Ambari Views. This was addressed in Apache Ambari 2.7.4.CVE-2020-193607.5Local file inclusion in FHEM 6.0 allows in fhem/FileLog_logWrapper file parameter can allow an attacker to include a file, which can lead toCVE-2020-193616.1Reflected XSS in Medintux v2.16.000 CCAM.php by manipulating the mot1 parameter can result in an attacker performing malicious actions to usCVE-2020-193626.1Reflected XSS in Vtiger CRM v7.2.0 in vtigercrm/index.php? through the view parameter can result in an attacker performing malicious actionsCVE-2020-193636.5Vtiger CRM v7.2.0 allows an attacker to display hidden files, list directories by using /libraries and /layout directories.CVE-2020-193648.8OpenEMR 5.0.1 allows an authenticated attacker to upload and execute malicious PHP scripts through /controller.php.CVE-2020-19378.8Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run malicious database qu