CVE-2020-13948
Apache Superset OS Command Injection
描述
While investigating a bug report on Apache Superset, it was determined that an authenticated user could craft requests via a number of templated text fields in the product that would allow arbitrary access to Python’s `os` package in the web application process in versions < 0.37.1. It was thus possible for an authenticated user to list and access files, environment variables, and process information. Additionally it was possible to set environment variables for the current process, create and update files in folders writable by the web process, and execute arbitrary programs accessible by the web process. All other operations available to the `os` package in Python were also available, even if not explicitly enumerated in this CVE.
如何修補 CVE-2020-13948
要修補 CVE-2020-13948,請將受影響套件升級到下列已修補版本。
- —升級至 0.37.1 或更新版本
- —升級至 0.37.1 或更新版本
- —升級至 0.37.1 或更新版本
CVE-2020-13948 正在被利用嗎?
低 — EPSS 為 3.1%,目前沒有觀察到大規模利用活動。
受影響套件(3)
- from 0, < 0.37.1
- from 0, < 0.37.1
- from 0, < 0.37.1
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |