{"cve":"CVE-2020-13952","nvd":{"published":"2020-09-30T21:15:12.807","modified":"2026-06-17T02:53:59.133","status":"Modified","description":"In the course of work on the open source project it was discovered that authenticated users running queries against Hive and Presto database engines could access information via a number of templated fields including the contents of query description metadata database, the hashed version of the authenticated users’ password, and access to connection information including the plaintext password for the current connection. It would also be possible to run arbitrary methods on the database connection object for the Presto or Hive connection, allowing the user to bypass security controls internal to Superset. This vulnerability is present in every Apache Superset version < 0.37.2.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","score":8.1},"cwes":[],"references":["https://lists.apache.org/thread.html/rf1faa368f580d2cb691576bee1277855f769667f3114d5df1dacbea6%40%3Cdev.superset.apache.org%3E","https://lists.apache.org/thread.html/rf1faa368f580d2cb691576bee1277855f769667f3114d5df1dacbea6%40%3Cdev.superset.apache.org%3E"],"products":["apache:superset"],"source":"nvd","synced_at":"2026-10-19T21:09:53.489947993+00:00"},"epss":{"cve":"CVE-2020-13952","score":0.02018,"percentile":0.80932,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-77pw-c3j2-5fc8","url":"https://osv.dev/vulnerability/GHSA-77pw-c3j2-5fc8","summary":"Plaintext password leak in Apache Superset","modified":"2025-02-05T09:11:44.815394Z","packages":[{"ecosystem":"PyPI","name":"apache-superset","purl":"pkg:pypi/apache-superset","ranges":["<0.37.2"],"fixed":["0.37.2"]}]},{"id":"PYSEC-2020-223","url":"https://osv.dev/vulnerability/PYSEC-2020-223","summary":"","modified":"2025-02-05T09:11:44.815394Z","packages":[{"ecosystem":"PyPI","name":"apache-superset","purl":"pkg:pypi/apache-superset","ranges":["<0.37.2"],"fixed":["0.37.2"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}