CVE-2022-41703

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A vulnerability in the SQL Alchemy connector of Apache Superset allows an authenticated user with read access to a specific database to add subqueries to the WHERE and HAVING fields referencing tables on the same database that the user should not have access to, despite the user having the feature flag "ALLOW_ADHOC_SUBQUERY" disabled (default value). This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-89

Affected software

VendorProductVersions
Apache Software FoundationApache Superset>= 2.0.0, < 2.0.1; <= 1.5.2

References

Timeline

Published
Jan 16, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-417047.5A vulnerability in Batik of Apache XML Graphics allows an attacker to run untrusted Java code from an SVG. This issue affects Apache XML GraCVE-2022-417059.8Badaso version 2.6.3 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because thCVE-2022-417068.2Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application doCVE-2022-417076.5Relatedcode's Messenger version 7bcd20b allows an authenticated external attacker to access sensitive data of any user of the application. TCVE-2022-417084.3Relatedcode's Messenger version 7bcd20b allows an authenticated external attacker to access existing chats in the workspaces of any user of CVE-2022-417097.8Markdownify version 1.4.1 allows an external attacker to execute arbitrary code remotely on any client attempting to view a malicious markdoCVE-2022-41717.5The demon image annotation plugin for WordPress is vulnerable to improper input validation in versions up to, and including 5.0. This is dueCVE-2022-417105.5Markdownify version 1.4.1 allows an external attacker to remotely obtain arbitrary local files on any client that attempts to view a malicioCVE-2022-417119.8Badaso version 2.6.0 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because thCVE-2022-417126.5Frappe version 14.10.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does nCVE-2022-417135.3deep-object-diff version 1.1.0 allows an external attacker to edit or add new properties to an object. This is possible because the applicatCVE-2022-417145.3fastest-json-copy version 1.0.1 allows an external attacker to edit or add new properties to an object. This is possible because the applica
CVE-2022-41703: Medium severity, CVSS 5.4 | Vulnix