Security Advisory

CVE-2025-48912

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2025-05-30 08:26:15

Last updated 2025-05-31 00:11:45

Assigner apache

CVSS score 7.1

State PUBLISHED

Description

An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields. This allowed the execution of sub-queries to evade parsing defenses ultimately granting unauthorized access to data. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue.

← Browse all CVEs View on cve.org ↗