cve.bz

CVE-2023-37941

6.6 mediumEPSS 35%

Medium (6.6) in apache superset. EPSS 35% chance of exploitation in the next 30 days. Fixed in apache-superset 2.1.1.

If an attacker gains write access to the Apache Superset metadata database, they could persist a specifically crafted Python object that may lead to remote code execution on Superset's web backend. The Superset metadata db is an 'internal' component that is typically only accessible directly by the system administrator and the superset process itself. Gaining access to that database should be difficult and require significant privileges. This vulnerability impacts Apache Superset versions 1.5.0 up to and including 2.1.0. Users are recommended to upgrade to version 2.1.1 or later.

Severity

CVSS 3.1

6.6 medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS
35% chance of exploitation in the next 30 days; higher than 98% of CVEs (scores of 2026-10-31)
CWE
CWE-502
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-fj4x-m62j-wvwgPyPIapache-superset>=1.5.0 <2.1.12.1.1
PYSEC-2026-1175PyPIapache-superset>=1.5.0 <2.1.12.1.1

References

Check your stackJSON