CVE-2023-27524—Apache Superset Insecure Default Initialization of Resource Vulnerability

漏洞名称

Apache Superset Insecure Default Initialization of Resource Vulnerability

描述

Apache Superset contains an insecure default initialization of a resource vulnerability that allows an attacker to authenticate and access unauthorized resources on installations that have not altered the default configured SECRET_KEY according to installation instructions.

已知用于勒索软件活动吗？

勒索软件状态：

Unknown

采集行动

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

其他说明

• https://lists.apache.org/thread/n0ftx60sllf527j7g11kmt24wvof8xyk
• https://nvd.nist.gov/vuln/detail/CVE-2023-27524

相关 CWE

• CWE-1188