CVE-2022-27479

SQL injection vulnerability in chart data API

State: Published
Severity: Not scored
Published: Apr 13, 2022
Updated: Aug 3, 2024
Reserved: Mar 21, 2022

Description

Apache Superset before 1.4.2 is vulnerable to SQL injection in chart data requests. Users should update to 1.4.2 or higher which addresses this issue.

Scores

The record has no CVSS score.

Weaknesses

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected Products

Product	Versions
Apache SupersetApache Software Foundation	before 1.4.2Affected

References

https://lists.apache.org/thread/94th50j5d0y2fw7ysx0g7w3t6jk3z7q6
https://lists.apache.org/thread/ztb9b6jd9rngoxwvq8r4fhpp401o613y
[oss-security] 20220413 CVE-2022-27479: Apache Superset: SQL injection vulnerability in chart data APImailing-list

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.