CVE-2023-49734

An authenticated Gamma user has the ability to create a dashboard and add charts to it, this user would automatically become one of the owners of the charts allowing him to incorrectly have write permissions to these charts.This issue affects Apache Superset: before 2.1.2, from 3.0.0 before 3.0.2. Users are recommended to upgrade to version 3.0.2 or 2.1.3, which fixes the issue.

• CWE-863

• http://www.openwall.com/lists/oss-security/2023/12/19/3Mailing List, Third Party Advisory
• https://lists.apache.org/thread/985h6ltvtbvdoysso780kkj7x744cds5Mailing List, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2023/12/19/3Mailing List, Third Party Advisory
• https://lists.apache.org/thread/985h6ltvtbvdoysso780kkj7x744cds5Mailing List, Vendor Advisory

Published

Dec 19, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-49716 In Emerson Rosemount GC370XA, GC700XA, and GC1500XA product…9.8
• CVE-2023-4972Incorrect Use of Privileged APIs vulnerability in Yepas Digi…9.8
• CVE-2023-49721An insecure default to allow UEFI Shell in EDK2 was left ena…6.7
• CVE-2023-49722Network port 8899 open in WiFi firmware of BCC101/BCC102/BCC…6.5
• CVE-2023-4973A vulnerability was found in Academy LMS 6.2 on Windows. It …6.1
• CVE-2023-49733Improper Restriction of XML External Entity Reference vulner…9.8
• CVE-2023-49735** UNSUPPORTED WHEN ASSIGNED ** The value set as the Defaul…7.5
• CVE-2023-49736A where_in JINJA macro allows users to specify a quote, whic…8.8
• CVE-2023-49738An information disclosure vulnerability exists in the image4…7.5
• CVE-2023-49739Vulnerability in IdeaBox Creations PowerPack Pro for Element…6.1
• CVE-2023-4974A vulnerability was found in Academy LMS 6.2. It has been ra…9.8
• CVE-2023-49740Improper Neutralization of Input During Web Page Generation …6.1