CVE-2023-46104

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets. This vulnerability exists in Apache Superset versions up to and including 2.1.2 and versions 3.0.0, 3.0.1.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published: Dec 19, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-46116.3A use-after-free flaw was found in mm/mempolicy.c in the memory management subsystem in the Linux Kernel. This issue is caused by a race bet CVE-2023-461155.5Tauri is a framework for building binaries for all major desktop platforms. This advisory is not describing a vulnerability in the Tauri cod CVE-2023-461168.8Tutanota (Tuta Mail) is an encrypted email provider. Tutanota allows users to open links in emails in external applications. Prior to versio CVE-2023-461178.8reconFTW is a tool designed to perform automated recon on a target domain by running the best set of tools to perform scanning and finding o CVE-2023-461184.9RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for d CVE-2023-461197.5Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server crashes when uploading CVE-2023-46129.8Improper Authentication vulnerability in Apereo CAS in jakarta.servlet.http.HttpServletRequest.getRemoteAddr method allows Multi-Factor Auth CVE-2023-461207.5The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. `maxBodyLebgth` was CVE-2023-461213.7yt-dlp is a youtube-dl fork with additional features and fixes. The Generic Extractor in yt-dlp is vulnerable to an attacker setting an arbi CVE-2023-461227.1sbt is a build tool for Scala, Java, and others. Given a specially crafted zip or JAR file, `IO.unzip` allows writing of arbitrary file. Thi CVE-2023-461235.3jumpserver is an open source bastion machine, professional operation and maintenance security audit system that complies with 4A specificati CVE-2023-461247.2Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in runtime environments, and the