Vulnerability Details : CVE-2018-8021
Public exploit exists!
Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to possible remote code execution. Note Superset 0.23 was released prior to any Superset release under the Apache Software Foundation.
Vulnerability category: Execute code
Products affected by CVE-2018-8021
- cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2018-8021
94.82%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 99 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2018-8021
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST | |
|
9.8
|
CRITICAL | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST |
CWE ids for CVE-2018-8021
-
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.Assigned by: nvd@nist.gov (Primary)
References for CVE-2018-8021
-
https://github.com/apache/incubator-superset/pull/4243
Use json for imports and exports, not pickle by timifasubaa · Pull Request #4243 · apache/incubator-superset · GitHubPatch;Third Party Advisory
-
https://www.exploit-db.com/exploits/45933/
Apache Superset < 0.23 - Remote Code ExecutionExploit;Third Party Advisory;VDB Entry
Jump to