id: PYSEC-2019-172
details: In Apache Incubator Superset before 0.31 user could query database metadata
  information from a database he has no access to, by using a specially crafted complex
  query.
affected:
- package:
    name: apache-superset
    ecosystem: PyPI
    purl: pkg:pypi/apache-superset
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: '0'
    - fixed: '0.31'
references:
- type: WEB
  url: https://lists.apache.org/thread.html/85ab04f8c52df8c353ecfa0ecd2ff27fc07fb8ab7566a754349806be%40%3Cdev.superset.apache.org%3E
- type: ADVISORY
  url: https://github.com/advisories/GHSA-p5w7-qmq6-pmjr
aliases:
- CVE-2019-12413
- GHSA-p5w7-qmq6-pmjr
modified: '2020-08-24T17:37:00Z'
published: '2019-12-16T22:15:00Z'