CVE-2023-25504: Apache Superset: Possible SSRF on import datasets

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-04-17 · updated 2026-06-17
Weakness: CWE-918

Description

A malicious actor who has been authenticated and granted specific permissions in Apache Superset may use the import dataset feature in order to conduct Server-Side Request Forgery attacks and query internal resources on behalf of the server where Superset is deployed. This vulnerability exists in Apache Superset versions up to and including 2.0.1.

Affected products

Apache Superset: through 2.0.1

References

http://www.openwall.com/lists/oss-security/2023/04/18/8
https://lists.apache.org/thread/tdnzkocfsqg2sbbornnp9g492fn4zhtx
http://www.openwall.com/lists/oss-security/2023/04/18/8
https://lists.apache.org/thread/tdnzkocfsqg2sbbornnp9g492fn4zhtx

Get alerted when CVE-2023-25504 or the next vulnerability affects your stack