Possible SQL Injection when template processing is enabled (CVE-2021-41971)

Summary

Possible SQL Injection when template processing is enabled

Original description

The description as published by the source.

Apache Superset up to and including 1.3.0 when configured with ENABLE_TEMPLATE_PROCESSING on (disabled by default) allowed SQL injection when a malicious authenticated user sends an http request with a custom URL.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Affected packages

Bitnami superset

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.3.1"}]}]

References

advisory lists.apache.org
web nvd.nist.gov