-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper input validation when configuring MariaDB connections. The MySQLEngineSpec class's parameter handling would be the logical place where 'local_infile' could be enabled through user-controlled input. The DatabaseView POST handler would be responsible for accepting these parameters. While exact code isn't available, these components align with the described attack vector (configuring dangerous DB parameters) and CWE-20 pattern. The high confidence for MySQLEngineSpec comes from its direct role in DB configuration, while the view handler gets medium confidence due to typical MVC patterns in web apps.
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| apache-superset | pip | < 3.1.3 | 3.1.3 |
| apache-superset | pip | >= 4.0.0, < 4.0.1 | 4.0.1 |
Ongoing coverage of React2Shell