What’s Vulnerable › Vulnerabilities

CVE-2024-27315: Apache Superset: Improper error handling on alerts

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-02-28 · updated 2026-06-17
• Weakness: CWE-209

Description

An authenticated user with privileges to create Alerts on Alerts & Reports has the capability to generate a specially crafted SQL statement that triggers an error on the database. This error is not properly handled by Apache Superset and may inadvertently surface in the error log of the Alert exposing possibly sensitive data. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue.

Affected products

• Apache Superset: before 3.0.4; from 3.1.0 before 3.1.1 — fixed in 3.0.4, 3.1.1

How to fix

Upgrade to a fixed version: Apache Superset 3.0.4, 3.1.1. Check the vendor advisory for mitigations.

References

• https://lists.apache.org/thread/qcwbx7q2s3ynsd405895bx3wcwq32j7z
• http://www.openwall.com/lists/oss-security/2024/02/28/3
• https://lists.apache.org/thread/qcwbx7q2s3ynsd405895bx3wcwq32j7z

Get alerted when CVE-2024-27315 or the next vulnerability affects your stack