CVE-2023-25504

A malicious actor who has been authenticated and granted specific permissions in Apache Superset may use the import dataset feature in order to conduct Server-Side Request Forgery attacks and query internal resources on behalf of the server where Superset is deployed. This vulnerability exists in Apache Superset versions up to and including 2.0.1.

• CWE-918
• CWE-918

• http://www.openwall.com/lists/oss-security/2023/04/18/8Mailing List, Third Party Advisory
• https://lists.apache.org/thread/tdnzkocfsqg2sbbornnp9g492fn4zhtxMailing List
• http://www.openwall.com/lists/oss-security/2023/04/18/8Mailing List, Third Party Advisory
• https://lists.apache.org/thread/tdnzkocfsqg2sbbornnp9g492fn4zhtxMailing List

Published

Apr 17, 2023

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-25494 A potential vulnerability were reported in the BIOS of some…6.7
• CVE-2023-25495A valid, authenticated administrative user can query a web i…4.9
• CVE-2023-25496A privilege escalation vulnerability was reported in Lenovo …7.8
• CVE-2023-25499When adding non-visible components to the UI in server side,…6.5
• CVE-2023-2550Cross-site Scripting (XSS) - Stored in GitHub repository tho…4.8
• CVE-2023-25500Possible information disclosure in Vaadin 10.0.0 to 10.0.23,…4.3
• CVE-2023-25505NVIDIA DGX-1 BMC contains a vulnerability in the IPMI handle…7.8
• CVE-2023-25506NVIDIA DGX-1 contains a vulnerability in Ofbd in AMI SBIOS, …8.2
• CVE-2023-25507NVIDIA DGX-1 BMC contains a vulnerability in the SPX REST AP…8.8
• CVE-2023-25508NVIDIA DGX-1 BMC contains a vulnerability in the IPMI handle…7.8
• CVE-2023-25509NVIDIA DGX-1 SBIOS contains a vulnerability in Bds, which ma…7.8
• CVE-2023-2551PHP Remote File Inclusion in GitHub repository unilogies/bum…8.8