{"containers": {"cna": {"affected": [{"product": "Apache Superset", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "1.3.2", "status": "affected", "version": "Apache Superset", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Found and reported by Cesar Santos"}], "descriptions": [{"lang": "en", "value": "Apache Superset up to and including 1.3.2 allowed for registered database connections password leak for authenticated users. This information could be accessed in a non-trivial way. Users should upgrade to Apache Superset 1.4.0 or higher."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-522", "description": "CWE-522 Insufficiently Protected Credentials", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-02-01T13:16:32", "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://lists.apache.org/thread/xww1pccs2ckb5506wrf1v4lmxg198vkb"}], "source": {"discovery": "UNKNOWN"}, "title": "API sensitive information leak", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@apache.org", "ID": "CVE-2021-44451", "STATE": "PUBLIC", "TITLE": "API sensitive information leak"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Apache Superset", "version": {"version_data": [{"version_affected": "<=", "version_name": "Apache Superset", "version_value": "1.3.2"}]}}]}, "vendor_name": "Apache Software Foundation"}]}}, "credit": [{"lang": "eng", "value": "Found and reported by Cesar Santos"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Apache Superset up to and including 1.3.2 allowed for registered database connections password leak for authenticated users. This information could be accessed in a non-trivial way. Users should upgrade to Apache Superset 1.4.0 or higher."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": [{}], "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-522 Insufficiently Protected Credentials"}]}]}, "references": {"reference_data": [{"name": "https://lists.apache.org/thread/xww1pccs2ckb5506wrf1v4lmxg198vkb", "refsource": "MISC", "url": "https://lists.apache.org/thread/xww1pccs2ckb5506wrf1v4lmxg198vkb"}]}, "source": {"discovery": "UNKNOWN"}}}}, "cveMetadata": {"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "assignerShortName": "apache", "cveId": "CVE-2021-44451", "datePublished": "2022-02-01T13:16:32", "dateReserved": "2021-11-30T00:00:00", "dateUpdated": "2022-02-01T13:16:32", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:*", "matchCriteriaId": "792D0A92-21FB-45E5-B010-BD57DB437827", "versionEndIncluding": "1.3.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Apache Superset up to and including 1.3.2 allowed for registered database connections password leak for authenticated users. This information could be accessed in a non-trivial way. Users should upgrade to Apache Superset 1.4.0 or higher."}, {"lang": "es", "value": "Apache Superset versiones hasta 1.3.2 incluy\u00e9ndola, permit\u00eda un filtrado de contrase\u00f1as de conexiones de bases de datos registradas para usuarios autenticados. Esta informaci\u00f3n pod\u00eda ser accedida de forma no trivial. Los usuarios deben actualizar a Apache Superset versi\u00f3n 1.4.0 o superior"}], "id": "CVE-2021-44451", "lastModified": "2022-02-05T02:06:44.807", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-02-01T14:15:09.483", "references": [{"source": "security@apache.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread/xww1pccs2ckb5506wrf1v4lmxg198vkb"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-522"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-522"}], "source": "security@apache.org", "type": "Secondary"}]}

{}