CVE-2022-41703 — Apache Superset: SQL injection vulnerability in adhoc clauses

Description (CNA)

A vulnerability in the SQL Alchemy connector of Apache Superset allows an authenticated user with read access to a specific database to add subqueries to the WHERE and HAVING fields referencing tables on the same database that the user should not have access to, despite the user having the feature flag "ALLOW_ADHOC_SUBQUERY" disabled (default value). This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache Superset	affected 2.0.0 before 2.0.1; affected 0 through 1.5.2

CWE

No CWE identifiers supplied.

References

https://lists.apache.org/thread/g7jjw0okxjk5y57pbbxy19ydw42kqcos

ADP enrichment

CVE

No English description supplied.

https://lists.apache.org/thread/g7jjw0okxjk5y57pbbxy19ydw42kqcos

CISA-ADP

No English description supplied.

No references supplied.