6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

CVE ID

CVE-2021-41972

GHSA ID

GHSA-42q4-9xf9-f67x

EPSS Score

0.52322%

CWE

CWE-522

Published

5/24/2022

Updated

11/18/2024

KEV Status

Technology

Python

Basic Information

CVE ID

GHSA ID

EPSS Score

CWE

Published

Updated

KEV Status

Technology

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2021-41972

CVE-2021-41972: Apache Superset allowed for database connections password leak for authenticated users

Apache Superset up to and including 1.3.1 allowed for database connections password leak for authenticated users. This information could be accessed in a non-trivial way.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2021-41972

CVE-2021-41972:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

CVE ID

CVE-2021-41972

GHSA ID

GHSA-42q4-9xf9-f67x

EPSS Score

0.52322%

CWE

CWE-522

Published

5/24/2022

Updated

11/18/2024

KEV Status

Technology

Python

Basic Information

CVE ID

GHSA ID

EPSS Score

CWE

Published

Updated

KEV Status

Technology

Technical Details

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
apache-superset	pip	<= 1.3.1	1.3.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability describes credential leakage through database connection handling. In Apache Superset architecture:

Database APIs (DatabaseApi.get) would handle database configuration retrieval
Admin views (DatabaseView.show) would render connection details Both would need to improperly expose password fields that should be masked. The CWE-522 mapping confirms this is about insufficient credential protection in storage/transmission. The 'non-trivial' access method suggests these functions required authentication but didn't properly filter sensitive fields from responses.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

6.5

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2021-41972: Apache Superset allowed for database connections password leak for authenticated users

CVE-2021-41972:

6.5

-

Basic Information

Basic Information

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Basic Information

Basic Information

Technical Details

CVE-2021-41972: Apache Superset allowed for database connections password leak for authenticated users

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

6.5

6.5

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI