CVE-2020-13952 json
Plaintext password leak in Apache Superset
published 6y ago modified 2mo ago also BIT-superset-2020-13952 , EUVD-2020-0046 , GHSA-77pw-c3j2-5fc8 , PYSEC-2020-223
- cvss
- 8.1
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.0%
- EPSS 2.0% chance of exploitation in 30 days, percentile 81%
- public exploits
- 0
- none known
Summary
In the course of work on the open source project it was discovered that authenticated users running queries against Hive and Presto database engines could access information via a number of templated fields including the contents of query description metadata database, the hashed version of the authenticated users’ password, and access to connection information including the plaintext password for the current connection. It would also be possible to run arbitrary methods on the database connection object for the Presto or Hive connection, allowing the user to bypass security controls internal to Superset. This vulnerability is present in every Apache Superset version < 0.37.2.
Patch / fix
- pypi apache-superset 0.37.2
- bitnami superset 0.37.2
- apache superset 0.37.2
Is CVE-2020-13952 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerExploit prediction
2.02% chance of exploitation in the next 30 days, higher than 81% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| GitHub | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| NVD | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| NVD | 2.0 | 5.5 | AV:N/AC:L/Au:S/C:P/I:P/A:N |
| OSV | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | apache-superset | <0.37.2 |
0.37.2 |
| bitnami | superset | <0.37.2 |
0.37.2 |
Affected products
- n/a Apache Superset
Classification
- Weakness
-
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
-
lists.apache.org
/thread.html/rf1faa368f580d2cb691576bee1277855f769667f3114d5df1dacbea6%40%3Cdev.superset.apache.org%3E
web, mailing-list, vendor-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2020-13952
advisory, web
-
github.com
/apache/superset
package
-
github.com
/pypa/advisory-database/tree/main/vulns/apache-superset/PYSEC-2020-223.yaml
web
-
github.com
/advisories/GHSA-77pw-c3j2-5fc8
advisory
Sources
- CVE List CVE-2020-13952
- GitHub Advisory GHSA-77pw-c3j2-5fc8
- NVD CVE-2020-13952
- OSV BIT-superset-2020-13952
- OSV PYSEC-2020-223
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.