CVE-2024-39887

An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. To mitigate this, a new configuration key named DISALLOWED_SQL_FUNCTIONS has been introduced. This key disallows the use of the following PostgreSQL functions: version, query_to_xml, inet_server_addr, and inet_client_addr. Additional functions can be added to this list for increased protection. This issue affects Apache Superset: before 4.0.2. Users are recommended to upgrade to version 4.0.2, which fixes the issue.

• CWE-89

• http://www.openwall.com/lists/oss-security/2024/07/16/5Mailing List, Third Party Advisory
• https://lists.apache.org/thread/j55vm41jg3l0x6w49zrmvbf3k0ts5fqzMailing List, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2024/07/16/5Mailing List, Third Party Advisory
• https://lists.apache.org/thread/j55vm41jg3l0x6w49zrmvbf3k0ts5fqzMailing List, Vendor Advisory

Published

Jul 16, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-39880Delta Electronics CNCSoft-G2 lacks proper validation of the …8.8
• CVE-2024-39881Delta Electronics CNCSoft-G2 lacks proper validation of user…8.8
• CVE-2024-39882Delta Electronics CNCSoft-G2 lacks proper validation of user…8.8
• CVE-2024-39883Delta Electronics CNCSoft-G2 lacks proper validation of the …8.8
• CVE-2024-39884A regression in the core of Apache HTTP Server 2.4.60 ignore…6.2
• CVE-2024-39886TONE store App version 3.4.2 and earlier contains an issue w…3.7
• CVE-2024-39888A vulnerability has been identified in Mendix Encryption (Al…8.7
• CVE-2024-3989The HT Mega – Absolute Addons For Elementor plugin for WordP…5.4
• CVE-2024-39890An issue was discovered in Samsung Mobile Processor, Wearabl…8.1
• CVE-2024-39891In the Twilio Authy API, accessed by Authy Android before 25…5.3
• CVE-2024-39894OpenSSH 9.5 through 9.7 before 9.8 sometimes allows timing a…7.5
• CVE-2024-39895Directus is a real-time API and App dashboard for managing S…6.5