CVE-2024-24772

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A guest user could exploit a chart data REST API and send arbitrary SQL statements that on error could leak information from the underlying analytics database.This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1.

Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Feb 28, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-247736.5Improper parsing of nested SQL statements on SQLLab would allow authenticated users to surpass their data authorization scope. This issue af CVE-2024-247744.1Mattermost Jira Plugin handling subscriptions fails to check the security level of an incoming issue or limit it based on the user who creat CVE-2024-247757.5When a virtual server is enabled with VLAN group and SNAT listener is configured, undisclosed traffic can cause the Traffic Management Micro CVE-2024-247764.3Mattermost fails to check the required permissions in the POST /api/v4/channels/stats/member_count API resulting in channel member counts be CVE-2024-247778.8A cross-site request forgery (CSRF) vulnerability exists in the Web Application functionality of the LevelOne WBR-6012 R0.40e6. A specially CVE-2024-247786.5Improper privilege management in a REST interface allowed registered users to access unauthorized resources if the resource ID was know. CVE-2024-247796.5Apache Superset with custom roles that include `can write on dataset` and without all data access permissions, allows for users to create vi CVE-2024-24789.8A vulnerability was found in BradWenqiang HR 2.0. It has been rated as critical. Affected by this issue is the function selectAll of the fil CVE-2024-247809.8Remote Code Execution with untrusted URI of UDF vulnerability in Apache IoTDB. The attacker who has privilege to create UDF can register mal CVE-2024-247817.5An unauthenticated remote attacker can use an uncontrolled resource consumption vulnerability to DoS the affected devices through excessive CVE-2024-247824.3An unauthenticated attacker can send a ping request from one network to another through an error in the origin verification even though the CVE-2024-247835.9Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This