Vulnerability Description
Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to possible remote code execution. Note Superset 0.23 was released prior to any Superset release under the Apache Software Foundation.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Superset | < 0.23 |
Related Weaknesses (CWE)
References
- https://github.com/apache/incubator-superset/pull/4243PatchThird Party Advisory
- https://www.exploit-db.com/exploits/45933/ExploitThird Party AdvisoryVDB Entry
- https://github.com/apache/incubator-superset/pull/4243PatchThird Party Advisory
- https://www.exploit-db.com/exploits/45933/ExploitThird Party AdvisoryVDB Entry
FAQ
What is CVE-2018-8021?
CVE-2018-8021 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to possible remote code execution. Note Superset 0.23 was released prior to any Supers...
How severe is CVE-2018-8021?
CVE-2018-8021 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2018-8021?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Superset.