高危

Apache Superset安全漏洞(CVE-2023-27524)

2023-04-24 15:28:16 公开，2026-07-07 20:07:29 更新

关键漏洞
CISA KEV
勒索软件漏洞
远程
无需认证
公开PoC
开源组件漏洞
2024两高一弱互联网漏洞
2024两高一弱内网漏洞
2025两高一弱漏洞

CWEs：: CWE-1188 （Initialization of a Resource with an Insecure Default）
CAPEC：: CAPEC-665 （Exploitation of Thunderbolt Protection Flaws）
SSVC：: 可利用状态：已被积极利用攻击自动化：否技术影响评估：全部 2025-02-04 00:30:35

风险信息

CVSS v3 向量: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v3 风险值: 9.8
CVSS v3.1 向量: AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
CVSS v3.1 风险值: 8.9

详细信息

漏洞类型: 其他
漏洞描述: 2.0.1及以下版本的Apache Superset中的会话验证攻击。未根据安装说明更改默认配置的SECRET_KEY的安装允许攻击者对未经授权的资源进行身份验证和访问。不影响已更改SECRET_KEY配置默认值的超级集管理员。
修复建议: 升级至Apache Superset的最新版本（2.1.0或更高版本），参考链接： https://superset.apache.org/ https://github.com/apache/superset

参考链接

http://packetstormsecurity.com/files/172522/Apache-Superset-2.0.0-Authentication-Bypass.html
OSV · Exploit · Third Party Advisory · VDB Entry
http://packetstormsecurity.com/files/175094/Apache-Superset-2.0.0-Remote-Code-Execution.html
OSV · Exploit · Third Party Advisory · VDB Entry
http://www.openwall.com/lists/oss-security/2023/04/24/2
OSV · Mailing List · Third Party Advisory
https://github.com/apache/superset
OSV
https://github.com/apache/superset/commit/b180319bbf08e876ea84963220ebebbfd0699e03
OSV
https://github.com/apache/superset/pull/23186
Snyk
https://github.com/apache/superset/releases/tag/2.1.0
Snyk
https://github.com/horizon3ai/CVE-2023-27524
Snyk
https://github.com/projectdiscovery/nuclei-templates/blob/master/cves/2023/CVE-2023-27524.yaml
Snyk
https://lists.apache.org/thread/n0ftx60sllf527j7g11kmt24wvof8xyk
OSV · vendor-advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-27524
OSV
https://osv.dev/vulnerability/BIT-superset-2023-27524
OSV
https://osv.dev/vulnerability/CVE-2023-27524
OSV
https://osv.dev/vulnerability/GHSA-5cx2-vq3h-x52c
OSV
https://packetstormsecurity.com/files/172522/Apache-Superset-2.0.0-Authentication-Bypass.html
CVE · Third Party Advisory · VDB Entry · Exploit
https://packetstormsecurity.com/files/175094/Apache-Superset-2.0.0-Remote-Code-Execution.html
CVE · Third Party Advisory · VDB Entry · Exploit
https://thehackernews.com/2023/04/apache-superset-vulnerability-insecure.html?m=1
Snyk
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Snyk
https://www.exploit-db.com/exploits/51447
Snyk
https://www.openwall.com/lists/oss-security/2023/04/24/2
CVE · Mailing List
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-27524
OSV · US Government Resource · Third Party Advisory
https://pypi.org/project/apache-superset
OSV
https://github.com/advisories/GHSA-5cx2-vq3h-x52c
OSV
https://osv.dev/vulnerability/PYSEC-2026-1161
OSV