Improper access to dataset metadata information
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 1.3%
exploitation probability
1.3%top 33% of all CVEs
observed exploitation
nono source reports it
Apache Superset up to 1.5.1 allowed for authenticated users to access metadata information related to datasets they have no permission on. This metadata included the dataset name, columns and metrics.
Affected products
Apache Software Foundation · Apache Superset