{"containers": {"cna": {"affected": [{"product": "Superset", "vendor": "unspecified", "versions": [{"status": "affected", "version": "prior to 0.23"}]}], "datePublic": "2018-11-06T00:00:00", "descriptions": [{"lang": "en", "value": "Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to possible remote code execution. Note Superset 0.23 was released prior to any Superset release under the Apache Software Foundation."}], "problemTypes": [{"descriptions": [{"description": "RCE", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-12-05T10:57:01", "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache"}, "references": [{"name": "45933", "tags": ["exploit", "x_refsource_EXPLOIT-DB"], "url": "https://www.exploit-db.com/exploits/45933/"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/apache/incubator-superset/pull/4243"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "[email protected]", "ID": "CVE-2018-8021", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Superset", "version": {"version_data": [{"version_value": "prior to 0.23"}]}}]}, "vendor_name": ""}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to possible remote code execution. Note Superset 0.23 was released prior to any Superset release under the Apache Software Foundation."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "RCE"}]}]}, "references": {"reference_data": [{"name": "45933", "refsource": "EXPLOIT-DB", "url": "https://www.exploit-db.com/exploits/45933/"}, {"name": "https://github.com/apache/incubator-superset/pull/4243", "refsource": "MISC", "url": "https://github.com/apache/incubator-superset/pull/4243"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T06:46:11.477Z"}, "title": "CVE Program Container", "references": [{"name": "45933", "tags": ["exploit", "x_refsource_EXPLOIT-DB", "x_transferred"], "url": "https://www.exploit-db.com/exploits/45933/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/apache/incubator-superset/pull/4243"}]}]}, "cveMetadata": {"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "assignerShortName": "apache", "cveId": "CVE-2018-8021", "datePublished": "2018-11-07T14:00:00", "dateReserved": "2018-03-09T00:00:00", "dateUpdated": "2024-08-05T06:46:11.477Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:*", "matchCriteriaId": "AEDDD31B-A3CB-40BA-975A-877E75793029", "versionEndExcluding": "0.23", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to possible remote code execution. Note Superset 0.23 was released prior to any Superset release under the Apache Software Foundation."}, {"lang": "es", "value": "Las versiones anteriores a la 0.23 de Superset empleaban un m\u00e9todo inseguro de carga de la biblioteca pickle para deserializar datos, lo que conduce a una posible ejecuci\u00f3n remota de c\u00f3digo. Nota: Superset 0.23 se lanz\u00f3 antes que cualquier distribuci\u00f3n de Superset bajo la Apache Software Foundation."}], "id": "CVE-2018-8021", "lastModified": "2024-11-21T04:13:06.770", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "[email protected]", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "[email protected]", "type": "Primary"}]}, "published": "2018-11-07T14:29:00.947", "references": [{"source": "[email protected]", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/apache/incubator-superset/pull/4243"}, {"source": "[email protected]", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "https://www.exploit-db.com/exploits/45933/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/apache/incubator-superset/pull/4243"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "https://www.exploit-db.com/exploits/45933/"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "[email protected]", "type": "Primary"}]}

{}