CVE-2022-27479
Published: 13 April 2022
Summary
CVE-2022-27479 is a critical-severity SQL Injection (CWE-89) vulnerability in Apache Superset. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 10.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Apache Superset versions prior to 1.4.2 contain a SQL injection vulnerability in chart data requests, tracked as CVE-2022-27479 and assigned CWE-89. The flaw received a CVSS 3.1 score of 9.8, reflecting network-accessible exploitation with no required authentication or user interaction and full impact on confidentiality, integrity, and availability.
An unauthenticated remote attacker can submit crafted requests to the affected chart data endpoints and execute arbitrary SQL statements against the underlying database. Successful exploitation can result in unauthorized data access, modification, or deletion, as well as potential database takeover depending on the privileges of the Superset service account.
Apache advisories and the associated OSS-Security disclosure recommend immediate upgrade to Superset 1.4.2 or later, which contains the fix for the injection issue. The listed references point to the official Apache mailing-list threads that detail the patch and upgrade guidance.
EPSS scores for the CVE have remained low, with a current value of 0.0433 after a modest peak of 0.0552.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-0025
Vulnerability details
Apache Superset before 1.4.2 is vulnerable to SQL injection in chart data requests. Users should update to 1.4.2 or higher which addresses this issue.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.