Possible SQL Injection when template processing is enabled(CVE-2021-41971)

概要

Possible SQL Injection when template processing is enabled

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

Apache Superset up to and including 1.3.0 when configured with ENABLE_TEMPLATE_PROCESSING on (disabled by default) allowed SQL injection when a malicious authenticated user sends an http request with a custom URL.

出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

影響パッケージ

Bitnami superset

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.3.1"}]}]

参照URL

advisory lists.apache.org
web nvd.nist.gov