CVE-2024-24779

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Apache Superset with custom roles that include `can write on dataset` and without all data access permissions, allows for users to create virtual datasets to data they don't have access to. These users could then use those virtual datasets to get access to unauthorized data. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1.

Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Feb 28, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-24789.8A vulnerability was found in BradWenqiang HR 2.0. It has been rated as critical. Affected by this issue is the function selectAll of the fil CVE-2024-247809.8Remote Code Execution with untrusted URI of UDF vulnerability in Apache IoTDB. The attacker who has privilege to create UDF can register mal CVE-2024-247817.5An unauthenticated remote attacker can use an uncontrolled resource consumption vulnerability to DoS the affected devices through excessive CVE-2024-247824.3An unauthenticated attacker can send a ping request from one network to another through an error in the origin verification even though the CVE-2024-247835.9Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This CVE-2024-247847.5The ParseAddressList function incorrectly handles comments (text within parentheses) within display names. Since this is a misalignment with CVE-2024-247855.4If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of CVE-2024-247867.5The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when u CVE-2024-247876.4On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of CVE-2024-247885.9A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop.CVE-2024-247895.5The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalig CVE-2024-24793.5A vulnerability classified as problematic has been found in MHA Sistemas arMHAzena 9.6.0.0. This affects an unknown part of the component Ca