id: PYSEC-2019-173
details: In Apache Incubator Superset before 0.32, a user can view database names
  that he has no access to on a dropdown list in SQLLab
affected:
- package:
    name: apache-superset
    ecosystem: PyPI
    purl: pkg:pypi/apache-superset
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: '0'
    - fixed: '0.32'
references:
- type: WEB
  url: https://lists.apache.org/thread.html/396034aabe08dd349ff44eb062c718aadcf1b4e86f6372c7d5e988c0%40%3Cdev.superset.apache.org%3E
- type: ADVISORY
  url: https://github.com/advisories/GHSA-9c29-9h4m-wg5p
aliases:
- CVE-2019-12414
- GHSA-9c29-9h4m-wg5p
modified: '2019-12-19T18:24:00Z'
published: '2019-12-16T22:15:00Z'