CVE-2023-27525

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

An authenticated user with Gamma role authorization could have access to metadata information using non trivial methods in Apache Superset up to and including 2.0.1

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Superset	<= 2.0.1

References

https://lists.apache.org/thread/wpv7b17zjg2pmvpfkdd6nn8sco8y2q77Mailing List, Vendor Advisory
https://lists.apache.org/thread/wpv7b17zjg2pmvpfkdd6nn8sco8y2q77Mailing List, Vendor Advisory

Timeline

Published: Apr 17, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-275264.3A non Admin authenticated user could incorrectly create resources using the import charts feature, on Apache Superset up to and including 2.CVE-2023-275277.5Shinseiyo Sogo Soft (7.9A) and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XML file CVE-2023-275297.8Wacom Tablet Driver installer prior to 6.4.2-1 (for macOS) contains an improper link resolution before file access vulnerability. When a use CVE-2023-27535.4Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta.CVE-2023-275307.5A DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart MIME parsing code in which could al CVE-2023-275315.3There is a deserialization of untrusted data vulnerability in the Kredis JSON deserialization code CVE-2023-275327.5Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained. This CVE-2023-275338.8A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on mali CVE-2023-275348.8A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as CVE-2023-275355.9An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in wrong credentials bei CVE-2023-275365.9An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connecti CVE-2023-275375.9A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing was introduced without