CVE-2023-39264

Published: Sep 6, 2023Modified: Jun 17, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vulnerability exists in Apache Superset versions up to and including 2.1.0.

Affected (1)

Products: Apache: Superset

Apache

1 product

Superset

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Superset	Up to 2.1.0

Related CWEs

CWE-209

Generation of Error Message Containing Sensitive Information

The product generates an error message that includes sensitive information about its environment, users, or associated data.

References (2)

https://lists.apache.org/thread/y65t1of7hb445n86o1vdzjct7rfwlx75

Source: security@apache.org

Mailing List

https://lists.apache.org/thread/y65t1of7hb445n86o1vdzjct7rfwlx75

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

Timeline

No history available yet.