CVE-2024-53947

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Superset. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. This issue is a follow-up to CVE-2024-39887 with additional disallowed PostgreSQL functions now included: query_to_xml_and_xmlschema, table_to_xml, table_to_xml_and_xmlschema. This issue affects Apache Superset: <4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue or add these Postgres functions to the config set DISALLOWED_SQL_FUNCTIONS.

• CWE-89

• https://lists.apache.org/thread/hj3gfsjh67vqw12nlrshlsym4bkopjmnMailing List, Vendor Advisory

Published

Dec 9, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-53941An issue was discovered in Victure RX1800 WiFi 6 Router (sof…8.8
• CVE-2024-53942An issue was discovered on NRadio N8-180 NROS-1.9.2.n3.c5 de…4.8
• CVE-2024-53943An issue was discovered in NRadio N8-180 NROS-1.9.2.n3.c5 de…6.1
• CVE-2024-53944An issue was discovered on Tuoshi/Dionlink LT15D 4G Wi-Fi de…9.8
• CVE-2024-53945The KuWFi 4G AC900 LTE router 1.0.13 is vulnerable to comman…8.8
• CVE-2024-53946The KuWFi 4G LTE AC900 router 1.0.13 is vulnerable to Cross-…8.8
• CVE-2024-53948Generation of Error Message Containing analytics metadata In…5.3
• CVE-2024-53949Improper Authorization vulnerability in Apache Superset when…6.5
• CVE-2024-5395A vulnerability was found in itsourcecode Online Student Enr…8.8
• CVE-2024-53951InDesign Desktop versions ID19.5, ID18.5.4 and earlier are a…5.5
• CVE-2024-53952InDesign Desktop versions ID19.5, ID18.5.4 and earlier are a…5.5
• CVE-2024-53953Animate versions 23.0.8, 24.0.5 and earlier are affected by …7.8