CVE-2023-30776: Insufficiently Protected Credentials

April 24, 2023 (updated June 15, 2023)

An authenticated user with specific data permissions could access database connections stored passwords by requesting a specific REST API. This issue affects Apache Superset version 1.3.0 up to 2.0.1.

References

www.openwall.com/lists/oss-security/2023/04/24/3
lists.apache.org/thread/s9w9w10mt2sngk3solwnmq5k7md53tsz
nvd.nist.gov/vuln/detail/CVE-2023-30776

Code Behaviors & Features

Detect and mitigate CVE-2023-30776 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →