CVE-2021-37839

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Apache Superset up to 1.5.1 allowed for authenticated users to access metadata information related to datasets they have no permission on. This metadata included the dataset name, columns and metrics.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-273

Affected software

No affected versions have been published.

Timeline

Published: Jul 6, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-37847.0Garuda Linux performs an insecure user creation and authentication that allows any user to impersonate the created account. By creating user CVE-2021-378408.8aaPanel through 6.8.12 allows Cross-Site WebSocket Hijacking (CSWH) involving OS commands within WebSocket messages at a ws:// URL for /webs CVE-2021-378417.8Docker Desktop before 3.6.0 suffers from incorrect access control. If a low-privileged account is able to access the server running the Wind CVE-2021-378427.5metakv in Couchbase Server 7.0.0 uses Cleartext for Storage of Sensitive Information. Remote Cluster XDCR credentials can get leaked in debu CVE-2021-378439.8The resolution SAML SSO apps for Atlassian products allow a remote attacker to login to a user account when only the username is known (i.e.CVE-2021-378453.7An issue was discovered in Citadel through webcit-932. A meddler-in-the-middle attacker can fixate their own session during the cleartext ph CVE-2021-378477.5crypto/digest.c in Pengutronix barebox through 2021.07.0 leaks timing information because memcmp is used during digest verification.CVE-2021-378487.5common/password.c in Pengutronix barebox through 2021.07.0 leaks timing information because strncmp is used during hash comparison.CVE-2021-37855.4yourls is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-378505.5ESET was made aware of a vulnerability in its consumer and business products for macOS that enables a user logged on to the system to stop t CVE-2021-378517.8Local privilege escalation in Windows products of ESET allows user who is logged into the system to exploit repair feature of the installer CVE-2021-378527.8ESET products for Windows allows untrusted process to impersonate the client of a pipe, which can be leveraged by attacker to escalate privi