CVE-2023-39264

Published Sep 6, 2023

Last updated a year ago

CVSS medium 4.3

Overview

Description: By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vulnerability exists in Apache Superset versions up to and including 2.1.0.
Source: security@apache.org
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 4.3
Impact score: 1.4
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Severity: MEDIUM

Weaknesses

security@apache.org: CWE-209

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A5C7318E-1118-457F-A2BC-8B9400AE7C3C",
            "versionEndIncluding": "2.1.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References