{"id":"CVE-2021-41972","published":"2021-11-12T18:55:13Z","modified":"2024-08-04T03:22:25Z","title":"Credentials leak","vendor":"Apache","product":"Apache Superset","tier":"tail","description":{"text":"Apache Superset up to and including 1.3.1 allowed for database connections password leak for authenticated users. This information could be accessed in a non-trivial way.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01497,"percentile":0.74122,"provenance":"source"},"cwes":[{"id":"CWE-522","name":"Insufficiently Protected Credentials"}],"references":[{"url":"https://lists.apache.org/thread/xpdl2r538o695o7r9gd9qrwqb17bdd3v","tags":["x_refsource_MISC"]},{"url":"https://seclists.org/oss-sec/2021/q4/106","tags":["x_refsource_MISC"]}],"priority":{"score":14.8,"factors":[{"name":"EPSS percentile","points":14.82}]},"vendorSlug":"apache","affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache Superset","versions":[">= Apache Superset, <= 1.3.1"]}],"affected":[{"ecosystem":"PyPI","package":"apache-superset","vulnerableRanges":["<1.3.2"],"patched":["1.3.2"],"from":["GHSA-42q4-9xf9-f67x","PYSEC-2021-434"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-0023","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2021-28125","published":"2021-04-27","fixed":"1.1.0","kev":false},{"cve":"CVE-2021-32609","published":"2021-10-18","fixed":"1.2.0","kev":false},{"cve":"CVE-2021-41971","published":"2021-10-18","fixed":"1.3.1","kev":false,"link":{"from":"CVE-2021-41971","to":"CVE-2021-41972","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:apache-superset","fromFixed":"1.3.1","toFixed":"1.3.2","daysApart":25}]}},{"cve":"CVE-2021-41972","published":"2021-11-12","fixed":"1.3.2","kev":false},{"cve":"CVE-2021-42250","published":"2021-11-17","fixed":"1.3.2","kev":false},{"cve":"CVE-2021-44451","published":"2022-02-01","fixed":"1.4.0","kev":false},{"cve":"CVE-2022-27479","published":"2022-04-13","fixed":"1.4.2","kev":false}],"package":"PyPI:apache-superset"}}