Loading...
Skip to main content
GeekWala

CVE-2024-53947 — Vulnerability in apache-superset — CVE Details

LOW

Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions

Published December 9, 2024Updated July 7, 2026Source: osv

Summary

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Superset. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. This issue is a follow-up to CVE-2024-39887 with additional disallowed PostgreSQL functions now included: query_to_xml_and_xmlschema, table_to_xml, table_to_xml_and_xmlschema. This issue affects Apache Superset: <4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue or add these Postgres functions to the config set DISALLOWED_SQL_FUNCTIONS.

Advisory Timeline

  • First published December 9, 2024 (672 days ago).
  • Last revised July 7, 2026 — 575 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

pip
Update apache-superset to 4.1.0 or later
pip install "apache-superset>=4.1.0"

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: pypi (1).

PackageEcosystemAffectedFixed In
apache-superset
pypi
0.34.0, 0.34.1, 0.35.1, 0.35.2 (+54 more)4.1.0

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2024-53947?
Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions This vulnerability has been assigned a severity rating of LOW (CVSS score: 9.8/10).
How do I check if my project is affected by CVE-2024-53947?
CVE-2024-53947 affects apache-superset. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2024-53947 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-92qf-8gh3-gwcm
BIT-superset-2024-53947
PYSEC-2026-1165

Related CVEs

More PyPI advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies