CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2023-04-24
Apache Superset Session Validation Bypass and Remote Code Execution via Default SECRET_KEY (CVE-2023-27524)
[Affected Scope] Apache Superset installations up to and including version 2.0.1 that have not altered the default configured SECRET_KEY.
[Impact] Unauthorized attackers can forge session cookies to authenticate as administrators, leading to unauthorized resource access, database compromise, and potential Remote Code Execution (RCE).
[Mitigation] Immediately configure a unique, cryptographically strong, randomly generated SECRET_KEY in 'superset_config.py' or via environment variables.