SCA: security update for apache-superset (GHSA-5cx2-vq3h-x52c)

critical Tenable Cloud Security Plugin ID 410777

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have
not altered the default configured SECRET_KEY according to installation instructions allow for an attacker
to authenticate and access unauthorized resources. This does not affect Superset administrators who have
changed the default value for SECRET_KEY config. All superset installations should always set a unique
secure random SECRET_KEY. Your SECRET_KEY is used to securely sign all session cookies and encrypting
sensitive information on the database. Add a strong SECRET_KEY to your `superset_config.py` file like:
SECRET_KEY = <YOUR_OWN_RANDOM_GENERATED_SECRET_KEY> Alternatively you can set it with
`SUPERSET_SECRET_KEY` environment variable. (CVE-2023-27524)

Plugin Details

Severity: Critical

ID: 410777

Version: Revision 1.8

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: High

Score: 7.6

Percentile: 98.48

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 8.3

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2023-27524

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 9.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 4/24/2023

Vulnerability Publication Date: 4/24/2023

CISA Known Exploited Vulnerability Due Dates: 1/29/2024

Exploitable With

Metasploit (Apache Superset Signed Cookie RCE)

Reference Information

CVE: CVE-2023-27524

cwe: CWE-1188

Detections

Analytics