Search: CVE-2024-39887

Apache Superset versions before 4.0.2 contain an SQL Injection vulnerability due to improper authorization checks on certain PostgreSQL engine-specific functions. This allows attackers to bypass SQL authorization by exploiting functions such as version, query_to_xml, inet_server_addr, and inet_client_addr. The vulnerability is fixed in version 4.0.2 by introducing a configuration key to disallow these functions.