API sensitive information leak
18Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendepss 7.9%
exploitation probability
7.9%top 6% of all CVEs
observed exploitation
nono source reports it
Apache Superset up to and including 1.3.2 allowed for registered database connections password leak for authenticated users. This information could be accessed in a non-trivial way. Users should upgrade to Apache Superset 1.4.0 or higher.
Affected products
Apache Software Foundation · Apache Superset