Pierluigi Paganini January 09, 2024

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Apache Superset vulnerability to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an Apache Superset flaw, tracked as CVE-2023-27524, to its Known Exploited Vulnerabilities (KEV) catalog.

Apache Superset is an open-source Data Visualization and Data Exploration Platform, it is written in Python and based on the Flask web framework.

In April 2022, Horizon3 researchers discovered a remote code execution, tracked as CVE-2023-27524 (CVSS score: 8.9), in Apache Superset.

Apache Superset contains an insecure default initialization of a resource vulnerability that allows an attacker to authenticate and access unauthorized resources on installations that have not altered the default configured SECRET_KEY according to installation instructions.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts recommend also private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix this vulnerability by January 29, 2024.

The US agency also added the following flaws to the KEV catalog:

• Adobe ColdFusion flaws CVE-2023-38203 and CVE-2023-29300;
• Apple Multiple Products flaw CVE-2023-41990. This issue was exploited as part of Operation Triangulation targeting Apple iOS devices.
• D-Link DSL-2750B Devices Command Injection Vulnerability CVE-2016-20017;
• Joomla! Improper Access Control Vulnerability CVE-2023-23752.

The above issues must be fixed by January 29, 2024, no one is known to be used in ransomware campaigns.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)