← Back to CVE List
Vulnerability Analysis
Apache Superset: Session validation vulnerability when using provided default SECRET_KEY

CVE-2023-27524

Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config. All superset installations should always set a unique secure random SECRET_KEY. Your SECRET_KEY is used to securely sign all session cookies and encrypting sensitive information on the database. Add a strong SECRET_KEY to your `superset_config.py` file like: SECRET_KEY = <YOUR_OWN_RANDOM_GENERATED_SECRET_KEY> Alternatively you can set it with `SUPERSET_SECRET_KEY` environment variable.

CISA KEV Nuclei Template
CVSS Base Score
8.9
HIGH
Exploitability:2.3
Impact Score:6.0
Temporal Score:-
EPSS:97.41%

Threat Intelligence Signals

CISA KEV
YES
KEV Date Added
2024-01-08
Ransomware Use
Unknown
KEV Due Date
2024-01-29
VulnCheck In-the-Wild
No
Nuclei Template
YES
EPSS Score
97.405%
EPSS Percentile
99.9th pct
GitHub Severity
HIGH
SSVC Exploitation
SSVC Automatable
Vulnerability Class

Identity & Timeline

Status-
Assigning Authority-
CVSS Version / Source-
Reserved-
Published-
Patch Date (date_public)-
Exploit DB Date-
First GitHub PoC Date-
Last Updated-
Time to Patch (Days to fix)-
Exploit Release Gap-
PoC Release Gap-
Exploit DB ReferencesNone identified

Affected Products & Versions

Vendor Product Affected Versions
No affected products specified.

References

No reference links found.

LINK COPIED TO CLIPBOARD