CVE-2024-24772: Apache Superset: Improper Neutralization of custom SQL on embedded context

February 28, 2024 (updated February 12, 2025)

A guest user could exploit a chart data REST API and send arbitrary SQL statements that on error could leak information from the underlying analytics database.This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1.

Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue.

References

github.com/advisories/GHSA-m6jm-3v38-76j4
github.com/apache/superset
lists.apache.org/thread/gfl3ckwy6y9tpz9jmpv62orh2q346sn5
nvd.nist.gov/vuln/detail/CVE-2024-24772

Code Behaviors & Features

Detect and mitigate CVE-2024-24772 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →