An authenticated user with specific data permissions could access database connections stored passwords by requesting a specific REST API. This issue affects Apache Superset version 1.3.0 up to 2.0.1.

Affected Packages

PyPI apache-superset

Affected versions: 1.3.0 (fixed in 2.1.0)

Related CVEs

CVE-2023-30776

Key Information

GHSA ID

GHSA-cmjc-52fg-9f7j

Published

July 6, 2023 7:24 PM

Last Modified

July 6, 2023 10:11 PM

CVSS Score

5.0 /10

Primary Ecosystem

PyPI

Primary Package

apache-superset

GitHub Reviewed

✓ Yes

Dataset

Last updated: July 27, 2025 6:35 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.