CVE-2022-27479

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Apache Superset before 1.4.2 is vulnerable to SQL injection in chart data requests. Users should update to 1.4.2 or higher which addresses this issue.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Superset	>= unspecified, < 1.4.2

References

http://www.openwall.com/lists/oss-security/2022/04/13/3Mailing List, Third Party Advisory
https://lists.apache.org/thread/94th50j5d0y2fw7ysx0g7w3t6jk3z7q6Broken Link
https://lists.apache.org/thread/ztb9b6jd9rngoxwvq8r4fhpp401o613yBroken Link
http://www.openwall.com/lists/oss-security/2022/04/13/3Mailing List, Third Party Advisory
https://lists.apache.org/thread/94th50j5d0y2fw7ysx0g7w3t6jk3z7q6Broken Link
https://lists.apache.org/thread/ztb9b6jd9rngoxwvq8r4fhpp401o613yBroken Link

Timeline

Published: Apr 13, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-27486.1A vulnerability was found in SourceCodester Simple Online Book Store System. It has been classified as problematic. Affected is an unknown f CVE-2022-274807.5A vulnerability has been identified in SICAM A8000 CP-8031 (All versions < V4.80), SICAM A8000 CP-8050 (All versions < V4.80). Affected devi CVE-2022-274815.3A vulnerability has been identified in SCALANCE W1788-1 M12 (All versions < V3.0.0), SCALANCE W1788-2 EEC M12 (All versions < V3.0.0), SCALA CVE-2022-274827.8A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiADC version 7.0.0 through 7.0.CVE-2022-274837.2A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiManager version 7.0.0 through CVE-2022-274844.3A unverified password change in Fortinet FortiADC version 6.2.0 through 6.2.3, 6.1.x, 6.0.x, 5.x.x allows an authenticated attacker to bypas CVE-2022-274856.5A improper neutralization of special elements used in an sql command ('sql injection') vulnerability [CWE-89] in Fortinet FortiSandbox versi CVE-2022-274867.8A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiDDoS version 5.5.0 through 5.5 CVE-2022-274878.8A improper privilege management in Fortinet FortiSandbox version 4.2.0 through 4.2.2, 4.0.0 through 4.0.2 and before 3.2.3 and FortiDeceptor CVE-2022-274888.8A cross-site request forgery (CSRF) in Fortinet FortiVoiceEnterprise version 6.4.x, 6.0.x, FortiSwitch version 7.0.0 through 7.0.4, 6.4.0 th CVE-2022-274897.2A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiExtender 7.0.0 through 7.0.3, CVE-2022-27498.8A vulnerability was found in SourceCodester Gym Management System. It has been declared as critical. Affected by this vulnerability is an un