CVE-2019-12413

5.3 mediumEPSS 2.8%

In Apache Incubator Superset before 0.31 user could query database metadata information from a database he has no access to, by using a specially crafted complex query.

Severity

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS: 2.8% chance of exploitation in the next 30 days; higher than 86% of CVEs (scores of 2026-10-31)
Published: 2019-12-16
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

apache:superset

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-p5w7-qmq6-pmjr	PyPI	apache-superset	<0.31.0	0.31.0
PYSEC-2019-172	PyPI	apache-superset	<0.31	0.31

References

https://lists.apache.org/thread.html/85ab04f8c52df8c353ecfa0ecd2ff27fc07fb8ab7566a754349806be%40%3Cdev.superset.apache.org%3E
https://lists.apache.org/thread.html/85ab04f8c52df8c353ecfa0ecd2ff27fc07fb8ab7566a754349806be%40%3Cdev.superset.apache.org%3E

Check your stack JSON