CVE-2023-27524

Producto

Apache / Superset

Vulnerabilidad

Apache Superset Insecure Default Initialization of Resource Vulnerability

Añadido a KEV

8 ene 2024

Remediar antes de

29 ene 2024

Uso conocido en ransomware

No

Descripción resumida

Apache Superset contains an insecure default initialization of a resource vulnerability that allows an attacker to authenticate and access unauthorized resources on installations that have not altered the default configured SECRET_KEY according to installation instructions.

Acción requerida

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notas

https://lists.apache.org/thread/n0ftx60sllf527j7g11kmt24wvof8xyk; https://nvd.nist.gov/vuln/detail/CVE-2023-27524