漏洞描述
Apache Superset through 1.3.2 contains a default login vulnerability via registered database connections for authenticated users. An attacker can obtain access to user accounts and thereby obtain sensitive information, modify data, and/or execute unauthorized operations.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
github.comhttps://github.com/detectify/ugly-duckling/blob/master/modules/crowdsourced/apache-superset-default-credentials.json↗lists.apache.orghttps://lists.apache.org/thread/xww1pccs2ckb5506wrf1v4lmxg198vkb↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2021-44451↗github.comhttps://github.com/ARPSyndicate/kenzer-templates↗github.comhttps://github.com/ARPSyndicate/cvemon↗