CVE-2023-46104

Published: Dec 19, 2023Modified: Feb 13, 2025

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets. This vulnerability exists in Apache Superset versions up to and including 2.1.2 and versions 3.0.0, 3.0.1.

Affected (2)

Products: Apache: Superset

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Apache Superset	Before 2.1.3
Apache Superset	From 3.0.0 to 3.0.1

Related CWEs

Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

References (8)

http://www.openwall.com/lists/oss-security/2023/12/19/1

Source: security@apache.org

Mailing List

http://www.openwall.com/lists/oss-security/2024/02/14/2

Source: security@apache.org

http://www.openwall.com/lists/oss-security/2024/02/14/3

Source: security@apache.org

https://lists.apache.org/thread/yxbxg4wryb7cb7wyybk11l5nqy0rsrvl

Source: security@apache.org

Vendor Advisory

http://www.openwall.com/lists/oss-security/2023/12/19/1

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

http://www.openwall.com/lists/oss-security/2024/02/14/2

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2024/02/14/3

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread/yxbxg4wryb7cb7wyybk11l5nqy0rsrvl

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.