{"containers": {"cna": {"affected": [{"product": "Superset", "vendor": "unspecified", "versions": [{"status": "affected", "version": "prior to 0.23"}]}], "datePublic": "2018-11-06T00:00:00", "descriptions": [{"lang": "en", "value": "Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to possible remote code execution. Note Superset 0.23 was released prior to any Superset release under the Apache Software Foundation."}], "problemTypes": [{"descriptions": [{"description": "RCE", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-12-05T10:57:01", "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache"}, "references": [{"name": "45933", "tags": ["exploit", "x_refsource_EXPLOIT-DB"], "url": "https://www.exploit-db.com/exploits/45933/"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/apache/incubator-superset/pull/4243"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@apache.org", "ID": "CVE-2018-8021", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Superset", "version": {"version_data": [{"version_value": "prior to 0.23"}]}}]}, "vendor_name": ""}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to possible remote code execution. Note Superset 0.23 was released prior to any Superset release under the Apache Software Foundation."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "RCE"}]}]}, "references": {"reference_data": [{"name": "45933", "refsource": "EXPLOIT-DB", "url": "https://www.exploit-db.com/exploits/45933/"}, {"name": "https://github.com/apache/incubator-superset/pull/4243", "refsource": "MISC", "url": "https://github.com/apache/incubator-superset/pull/4243"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T06:46:11.477Z"}, "title": "CVE Program Container", "references": [{"name": "45933", "tags": ["exploit", "x_refsource_EXPLOIT-DB", "x_transferred"], "url": "https://www.exploit-db.com/exploits/45933/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/apache/incubator-superset/pull/4243"}]}]}, "cveMetadata": {"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "assignerShortName": "apache", "cveId": "CVE-2018-8021", "datePublished": "2018-11-07T14:00:00", "dateReserved": "2018-03-09T00:00:00", "dateUpdated": "2024-08-05T06:46:11.477Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:*", "matchCriteriaId": "AEDDD31B-A3CB-40BA-975A-877E75793029", "versionEndExcluding": "0.23", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to possible remote code execution. Note Superset 0.23 was released prior to any Superset release under the Apache Software Foundation."}, {"lang": "es", "value": "Las versiones anteriores a la 0.23 de Superset empleaban un m\u00e9todo inseguro de carga de la biblioteca pickle para deserializar datos, lo que conduce a una posible ejecuci\u00f3n remota de c\u00f3digo. Nota: Superset 0.23 se lanz\u00f3 antes que cualquier distribuci\u00f3n de Superset bajo la Apache Software Foundation."}], "id": "CVE-2018-8021", "lastModified": "2024-11-21T04:13:06.770", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-11-07T14:29:00.947", "references": [{"source": "security@apache.org", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/apache/incubator-superset/pull/4243"}, {"source": "security@apache.org", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "https://www.exploit-db.com/exploits/45933/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/apache/incubator-superset/pull/4243"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "https://www.exploit-db.com/exploits/45933/"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}