ACTIEF MISBRUIKT
CVE-2023-27524: Apache Superset Insecure Default Initialization of Resource Vulnerability
| Leverancier | Apache |
|---|---|
| Product | Superset |
| Actief misbruikt | Ja |
| Toegevoegd aan CISA KEV | 8 jan 2024 |
| CISA-deadline (Amerikaanse overheid) | 29 jan 2024 |
| Zwakte (CWE) | CWE-1188 |
Vereiste actie (tekst van CISA, Engels)
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Beschrijving (NVD, Engels)
Apache Superset contains an insecure default initialization of a resource vulnerability that allows an attacker to authenticate and access unauthorized resources on installations that have not altered the default configured SECRET_KEY according to installation instructions.
BRONNEN
Andere lekken bij Apache
- CVE-2016-3081: Apache Struts Command Injection Vulnerability
- CVE-2026-34486: Apache Tomcat Missing Encryption of Sensitive Data Vulnerability
- CVE-2026-34197: Apache ActiveMQ Improper Input Validation Vulnerability
- CVE-2024-38475: Apache HTTP Server Improper Escaping of Output Vulnerability
- CVE-2025-24813: Apache Tomcat Path Equivalence Vulnerability
Gegevens van NVD, CISA KEV, FIRST EPSS en adviezen van leveranciers. Bijgewerkt 10 nov 2026.