영향받는 버전 라인
- 5.0 CVE 6건
- 4.1 CVE 13건
- 4.0 CVE 19건
- 3.1 CVE 25건
- 3.0 CVE 30건
- 2.1 CVE 44건
- 2.0 CVE 55건 KEV 1
- 1.5 CVE 55건 KEV 1
- 1.4 CVE 54건 KEV 1
- 1.3 CVE 58건 KEV 1
- 1.1 CVE 57건 KEV 1
- 1.0 CVE 59건 KEV 1
- 0.38 CVE 60건 KEV 1
- 0.37 CVE 62건 KEV 1
- 0.35 CVE 63건 KEV 1
- 0.34 CVE 63건 KEV 1
- 0.32 CVE 62건 KEV 1
- 0.31 CVE 63건 KEV 1
- 0.23 CVE 64건 KEV 1
알려진 취약점
| CVE | 제목 | 영향 버전 | CVSS | 악용 | EPSS | 공개일 |
|---|---|---|---|---|---|---|
| CVE-2023-27524 | Apache Superset: Session validation vulnerability when using provided default SECRET_KEY | ≤ 2.0.1 | 9.8 | KEV | 98.1% | 2023-04-24 |
| CVE-2026-23981 | Apache Superset: Improper Authorization in Chart Update allowing Dashboard Modification | < 6.0.0 | 5.3 | — | 2026-07-30 | |
| CVE-2026-23985 | Apache Superset: Regular Expression Denial of Service (ReDoS) in SQL Parser | ≥ 1.5.0 < 6.0.0 | 5.3 | — | 2026-07-30 | |
| CVE-2026-23983 | Apache Superset: Sensitive Data Exposure via REST API (disabled by default) | < 6.0.0 | 2.3 | — | 2026-02-24 | |
| CVE-2026-23984 | Apache Superset: SQLLab Read-Only Bypass on PostgreSQL | < 6.0.0 | 7.1 | — | 2026-02-24 | |
| CVE-2026-23969 | Apache Superset: Exposure of Sensitive Information via Incomplete ClickHouse Function Filtering | < 4.1.2 | 5.3 | — | 2026-02-24 | |
| CVE-2026-23980 | Apache Superset: Improper Neutralization of Special Elements used in a SQL Command | < 6.0.0 | 5.3 | — | 2026-02-24 | |
| CVE-2026-23982 | Apache Superset: Improper Authorization in Dataset Creation Allows Access Control Bypass | < 6.0.0 | 7.1 | — | 2026-02-24 | |
| CVE-2025-55672 | Apache Superset: Stored XSS on charts metadata | < 5.0.0 | 5.3 | — | 2025-08-14 | |
| CVE-2025-55673 | Apache Superset: Metadata exposure in embedded charts | < 4.1.3 | 5.3 | — | 2025-08-14 | |
| CVE-2025-55674 | Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions | < 5.0.0 | 5.3 | — | 2025-08-14 | |
| CVE-2025-55675 | Apache Superset: Incorrect datasource authorization on REST API | < 5.0.0 | 5.3 | — | 2025-08-14 | |
| CVE-2025-48912 | Apache Superset: Improper authorization bypass on row level security via SQL Injection | < 4.1.2 | 7.1 | — | 2025-05-30 | |
| CVE-2025-27696 | Apache Superset: Incorrect authorization leading to resource ownership takeover | < 4.1.2 | 5.3 | — | 2025-05-13 | |
| CVE-2024-55633 | Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access | < 4.1.0 | 7.1 | — | 2024-12-12 | |
| CVE-2024-53947 | Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions | < 4.1.0 | 2.3 | — | 2024-12-09 | |
| CVE-2024-53948 | Apache Superset: Error verbosity exposes metadata in analytics databases | < 4.1.0 | 5.3 | — | 2024-12-09 | |
| CVE-2024-53949 | Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled | ≥ 2.0.0 < 4.1.0 | 7.6 | — | 2024-12-09 | |
| CVE-2024-39887 | Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions | < 4.0.2 | 9.8 | — | 2024-07-16 | |
| CVE-2024-34693 | Apache Superset: Server arbitrary file read | < 3.1.3 ≥ 4.0.0 < 4.0.1 | 5.3 | — | 2024-06-20 | |
| CVE-2024-28148 | Apache Superset: Incorrect datasource authorization on explore REST API | < 4.0.0 | 4.3 | — | 2024-05-07 | |
| CVE-2024-24772 | Apache Superset: Improper Neutralisation of custom SQL on embedded context | < 3.0.4 ≥ 3.1.0 < 3.1.1 | 4.3 | — | 2024-02-28 | |
| CVE-2024-24773 | Apache Superset: Improper validation of SQL statements allows for unauthorized access to data | < 3.0.4 ≥ 3.1.0 < 3.1.1 | 6.5 | — | 2024-02-28 | |
| CVE-2024-24779 | Apache Superset: Improper data authorization when creating a new dataset | ≤ 3.0.4 ≥ 3.1.0 < 3.1.1 | 6.5 | — | 2024-02-28 | |
| CVE-2024-26016 | Apache Superset: Improper authorization validation on dashboards and charts import | < 3.0.4 ≥ 3.1.0 < 3.1.1 | 5.4 | — | 2024-02-28 | |
| CVE-2024-27315 | Apache Superset: Improper error handling on alerts | < 3.0.4 ≥ 3.1.0 < 3.1.1 | 4.3 | — | 2024-02-28 | |
| CVE-2024-23952 | Apache Superset: Allows for uncontrolled resource consumption via a ZIP bomb (version range fix for CVE-2023-4... | < 2.1.3 ≥ 3.0.0 < 3.0.2 | 6.5 | — | 2024-02-14 | |
| CVE-2023-49657 | Apache Superset: Stored XSS in Dashboard Title and Chart Title | < 3.0.3 | 5.4 | — | 2024-01-23 | |
| CVE-2023-49734 | Apache Superset: Privilege Escalation Vulnerability | < 2.1.2 ≥ 3.0.0 < 3.0.2 | 6.5 | — | 2023-12-19 | |
| CVE-2023-49736 | Apache Superset: SQL Injection on where_in JINJA macro | < 2.1.2 ≥ 3.0.0 < 3.0.2 | 8.8 | — | 2023-12-19 | |
| CVE-2023-46104 | Apache Superset: Allows for uncontrolled resource consumption via a ZIP bomb | < 2.1.3 ≥ 3.0.0 < 3.0.1 | 6.5 | — | 2023-12-19 | |
| CVE-2023-42504 | Apache Superset: Lack of rate limiting allows for possible denial of service | < 3.0.0 | 6.5 | — | 2023-11-28 | |
| CVE-2023-42505 | Apache Superset: Sensitive information disclosure on db connection details | < 3.0.0 | 4.3 | — | 2023-11-28 | |
| CVE-2023-42502 | Apache Superset: Open Redirect Vulnerability | < 3.0.0 | 5.4 | — | 2023-11-28 | |
| CVE-2023-40610 | Apache Superset: Privilege escalation with default examples database | < 2.1.2 | 8.8 | — | 2023-11-27 | |
| CVE-2023-42501 | Apache Superset: Unnecessary read permissions within the Gamma role | < 2.1.1 | 4.3 | — | 2023-11-27 | |
| CVE-2023-43701 | Apache Superset: Stored XSS on API endpoint | < 2.1.2 | 5.4 | — | 2023-11-27 | |
| CVE-2023-32672 | Apache Superset: SQL parser edge case bypasses data access authorization | ≤ 2.1.0 | 4.3 | — | 2023-09-06 | |
| CVE-2023-37941 | Apache Superset: Metadata db write access can lead to remote code execution | ≥ 1.5.0 ≤ 2.1.0 | 6.6 | — | 2023-09-06 | |
| CVE-2023-39265 | Apache Superset: Possible Unauthorized Registration of SQLite Database Connections | ≤ 2.1.0 | 6.5 | — | 2023-09-06 | |
| CVE-2023-36387 | Apache Superset: Improper API permission for low privilege users | * ≤ 2.1.0 | 5.4 | — | 2023-09-06 | |
| CVE-2023-27523 | Apache Superset: Improper data permission validation on Jinja templated queries | ≤ 2.1.0 | 4.3 | — | 2023-09-06 | |
| CVE-2023-27526 | Apache Superset: Improper Authorization check on import charts | ≤ 2.1.0 | 4.3 | — | 2023-09-06 | |
| CVE-2023-36388 | Apache Superset: Improper API permission for low privilege users allows for SSRF | ≤ 2.1.0 | 5.4 | — | 2023-09-06 | |
| CVE-2023-39264 | Apache Superset: Stack traces enabled by default | ≤ 2.1.0 | 4.3 | — | 2023-09-06 | |
| CVE-2023-30776 | Apache Superset: Database connection password leak | ≥ 1.3.0 ≤ 2.0.1 | 6.5 | — | 2023-04-24 | |
| CVE-2023-25504 | Apache Superset: Possible SSRF on import datasets | ≤ 2.0.1 | 6.5 | — | 2023-04-17 | |
| CVE-2023-27525 | Apache Superset: Incorrect default permissions for Gamma role | ≤ 2.0.1 | 4.3 | — | 2023-04-17 | |
| CVE-2022-41703 | Apache Superset: SQL injection vulnerability in adhoc clauses | ≤ 1.5.2 = 2.0.0 | 5.4 | — | 2023-01-16 | |
| CVE-2022-43717 | Apache Superset: Cross-Site Scripting on dashboards | ≤ 1.5.2 = 2.0.0 | 5.4 | — | 2023-01-16 | |
| CVE-2022-43718 | Apache Superset: Cross-Site Scripting vulnerability on upload forms | ≤ 1.5.2 = 2.0.0 | 5.4 | — | 2023-01-16 | |
| CVE-2022-43719 | Apache Superset: Cross Site Request Forgery (CSRF) on accept, request access API | ≤ 1.5.2 = 2.0.0 | 8.8 | — | 2023-01-16 | |
| CVE-2022-43720 | Apache Superset: Improper rendering of user input | ≤ 1.5.2 = 2.0.0 | 5.4 | — | 2023-01-16 | |
| CVE-2022-43721 | Apache Superset: Open Redirect Vulnerability | ≤ 1.5.2 = 2.0.0 | 5.4 | — | 2023-01-16 | |
| CVE-2022-45438 | Apache Superset: Dashboard metadata information leak | ≤ 1.5.2 = 2.0.0 | 5.3 | — | 2023-01-16 | |
| CVE-2021-37839 | Improper access to dataset metadata information | ≤ 1.5.1 | 4.3 | — | 2022-07-06 | |
| CVE-2022-27479 | SQL injection vulnerability in chart data API | < 1.4.2 | 9.8 | — | 2022-04-13 | |
| CVE-2021-44451 | API sensitive information leak | ≤ 1.3.2 | 6.5 | — | 2022-02-01 | |
| CVE-2021-42250 | Possible log injection | < 1.3.2 | 6.5 | — | 2021-11-17 | |
| CVE-2021-41972 | Credentials leak | ≤ 1.3.1 | 6.5 | — | 2021-11-12 |
내 서버의 버전을 직접 추적하세요
InfraGuard 는 모든 서버에 설치된 소프트웨어 버전을 수집하고, 알려진 취약점이 있는 버전을 알려 줍니다. 자체 호스팅이라 데이터가 내 네트워크를 벗어나지 않습니다.
데이터: CVE List(CVE® Program), NVD, CISA KEV, FIRST EPSS(EPSS 는 https://www.first.org/epss 참고), endoflife.date. 소프트웨어 목록: awesome-selfhosted(CC BY-SA 3.0).