Threats tagged 'bit-superset-2024-34693'

Apache Superset contains an improper input validation vulnerability (CVE-2024-34693) that allows an authenticated attacker to create a MariaDB connection with local_infile enabled. If the MariaDB server and the local MySQL client on the web server both permit local infile, the attacker can execute SQL commands to read arbitrary files from the server and insert their contents into a MariaDB database table. This affects versions before 3.1.3 and version 4.0.0. Upgrading to versions 3.1.3 or 4.0.1 resolves the issue.