id: PYSEC-2020-223
details: "In the course of work on the open source project it was discovered that\
  \ authenticated users running queries against Hive and Presto database engines could\
  \ access information via a number of templated fields including the contents of\
  \ query description metadata database, the hashed version of the authenticated users\u2019\
  \ password, and access to connection information including the plaintext password\
  \ for the current connection. It would also be possible to run arbitrary methods\
  \ on the database connection object for the Presto or Hive connection, allowing\
  \ the user to bypass security controls internal to Superset. This vulnerability\
  \ is present in every Apache Superset version < 0.37.2."
affected:
- package:
    name: apache-superset
    ecosystem: PyPI
    purl: pkg:pypi/apache-superset
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: '0'
    - fixed: 0.37.2
  versions:
  - 0.34.0
  - 0.34.1
  - 0.35.1
  - 0.35.2
  - 0.36.0
  - 0.37.0
  - 0.37.1
references:
- type: WEB
  url: https://lists.apache.org/thread.html/rf1faa368f580d2cb691576bee1277855f769667f3114d5df1dacbea6%40%3Cdev.superset.apache.org%3E
- type: ADVISORY
  url: https://github.com/advisories/GHSA-77pw-c3j2-5fc8
aliases:
- CVE-2020-13952
- GHSA-77pw-c3j2-5fc8
modified: '2021-08-27T03:21:55.668622Z'
published: '2020-09-30T21:15:00Z'