-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability explicitly references legacy REST API endpoints for approval and request access as the attack vector. In Flask-based applications like Superset, CSRF vulnerabilities typically occur when state-changing endpoints lack CSRF token validation(). Given the described functionality (access control operations) and the 'legacy' designation, these endpoints likely predate proper CSRF protection implementation. The functions would be part of the security API module handling user permissions, using HTTP methods vulnerable to forged requests without anti-CSRF mechanisms.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| apache-superset | pip | <= 1.5.2 | |
| apache-superset | pip | = 2.0.0 |