CVE-2024-23952

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

This is a duplicate for CVE-2023-46104. With correct CVE version ranges for affected Apache Superset. Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets. This vulnerability exists in Apache Superset versions up to and including 2.1.2 and versions 3.0.0, 3.0.1.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Superset	< 2.1.3; >= 3.0.0, < 3.0.2

References

http://www.openwall.com/lists/oss-security/2024/02/14/2Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/02/14/3Mailing List, Third Party Advisory
https://lists.apache.org/thread/zc58zvm4414molqn2m4d4vkrbrsxdksxVendor Advisory
http://www.openwall.com/lists/oss-security/2024/02/14/2Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/02/14/3Mailing List, Third Party Advisory
https://lists.apache.org/thread/zc58zvm4414molqn2m4d4vkrbrsxdksxVendor Advisory

Timeline

Published: Feb 14, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-239536.5Use of Arrays.equals() in LlapSignerImpl in Apache Hive to compare message signatures allows attacker to forge a valid signature for an arbi CVE-2024-239578.8Autel MaxiCharger AC Elite Business C50 DLB_HostHeartBeat Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerabilit CVE-2024-239588.8Autel MaxiCharger AC Elite Business C50 BLE Hardcoded Credentials Authentication Bypass Vulnerability. This vulnerability allows network-adj CVE-2024-239598.0Autel MaxiCharger AC Elite Business C50 BLE AppChargingControl Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnera CVE-2024-239604.6Alpine Halo9 Improper Verification of Cryptographic Signature Vulnerability. This vulnerability allows physically present attackers to bypas CVE-2024-239616.8Alpine Halo9 UPDM_wemCmdUpdFSpeDecomp Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present at CVE-2024-239625.3This vulnerability allows remote attackers to disclose sensitive information on affected installations of Alpine Halo9 devices. Authenticati CVE-2024-239638.0This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine Halo9 devices. An attacke CVE-2024-239678.0Autel MaxiCharger AC Elite Business C50 WebSocket Base64 Decoding Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vuln CVE-2024-239688.8This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging s CVE-2024-239698.8This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging s CVE-2024-23976.2Due to a bug in packet data buffers management, the PPP printer in tcpdump can enter an infinite loop when reading a crafted DLT_PPP_SERIAL