CVE-2023-39265

Apache Superset would allow for SQLite database connections to be incorrectly registered when an attacker uses alternative driver names like sqlite+pysqlite or by using database imports. This could allow for unexpected file creation on Superset webservers. Additionally, if Apache Superset is using a SQLite database for its metadata (not advised for production use) it could result in more severe vulnerabilities related to confidentiality and integrity. This vulnerability exists in Apache Superset versions up to and including 2.1.0.

• CWE-20

• http://packetstormsecurity.com/files/175094/Apache-Superset-2.0.0-Remote-Code-Execution.html
• https://lists.apache.org/thread/pwdzsdmv4g5g1n2h9m7ortfnxmhr7nfyVendor Advisory
• http://packetstormsecurity.com/files/175094/Apache-Superset-2.0.0-Remote-Code-Execution.html
• https://lists.apache.org/thread/pwdzsdmv4g5g1n2h9m7ortfnxmhr7nfyVendor Advisory

Published

Sep 6, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-39254Dell Update Package (DUP), Versions prior to 4.9.10 contain …7.3
• CVE-2023-39256 Dell Rugged Control Center, version prior to 4.7, contains …7.8
• CVE-2023-39257 Dell Rugged Control Center, version prior to 4.7, contains …7.8
• CVE-2023-39259 Dell OS Recovery Tool, versions 2.2.4013, 2.3.7012.0, and 2…7.8
• CVE-2023-39261In JetBrains IntelliJ IDEA before 2023.2 plugin for Space wa…7.8
• CVE-2023-39264By default, stack traces for errors were enabled, which resu…4.3
• CVE-2023-39266A vulnerability in the ArubaOS-Switch web management interfa…6.1
• CVE-2023-39267An authenticated remote code execution vulnerability exists …6.5
• CVE-2023-39268A memory corruption vulnerability in ArubaOS-Switch could le…9.8
• CVE-2023-39269A vulnerability has been identified in RUGGEDCOM i800, RUGGE…7.5
• CVE-2023-39270Multiple integer overflow vulnerabilities exist in the LXT2 …7.8
• CVE-2023-39271Multiple integer overflow vulnerabilities exist in the LXT2 …7.8