Strix
26.1K

CVE-2020-13952

HIGHCVSS 8.1/10EPSS 2.00%

Last modified

CVE-2020-13952 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. In the course of work on the open source project it was discovered that authenticated users running queries against Hive and Presto database engines could access information via a number of templated fields including the contents of query description metadata database, the hashed version of the authenticated users’ password, and access to connection information including the plaintext password for the current connection. It would also be possible to run arbitrary methods on the database connection object for the Presto or Hive connection, allowing the user to bypass security controls internal to Superset. EPSS estimates a 2.00% chance of exploitation in the next 30 days.

Description

In the course of work on the open source project it was discovered that authenticated users running queries against Hive and Presto database engines could access information via a number of templated fields including the contents of query description metadata database, the hashed version of the authenticated users’ password, and access to connection information including the plaintext password for the current connection. It would also be possible to run arbitrary methods on the database connection object for the Presto or Hive connection, allowing the user to bypass security controls internal to Superset. This vulnerability is present in every Apache Superset version < 0.37.2.

Metrics

CVSS 3.1
8.1/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS Probability
2.00%

78.2th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

VendorProductVersions
ApacheSuperset< 0.37.2

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2020-13952?
In the course of work on the open source project it was discovered that authenticated users running queries against Hive and Presto database engines could access information via a number of templated fields including the contents of query description metadata database, the hashed version of the authenticated users’ password, and access to connection information including the plaintext password for the current connection. It would also be possible to run arbitrary methods on the database connection object for the Presto or Hive connection, allowing the user to bypass security controls internal to Superset. This vulnerability is present in every Apache Superset version < 0.37.2.
How severe is CVE-2020-13952?
CVE-2020-13952 has a CVSS score of 8.1/10 (HIGH severity). The EPSS model estimates a 2.00% probability of exploitation in the next 30 days.
How do I fix CVE-2020-13952?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2020-13952?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST