KEVIntel

Vulnerability detail

Enriched intelligence for a single CVE

Back to KEVs

8.9

CVSS
High

CVE-2023-27524

PUBLISHED

Apache Superset: Session validation vulnerability when using provided default SECRET_KEY

Exploited in the wild Remote No user interaction

Vendor: Apache Software Foundation
Product: Apache Superset
Published: Apr 24, 2023
EPSS: —

Description

Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config. All superset installations should always set a unique secure random SECRET_KEY. Your SECRET_KEY is used to securely sign all session cookies and encrypting sensitive information on the database. Add a strong SECRET_KEY to your `superset_config.py` file like: SECRET_KEY = Alternatively you can set it with `SUPERSET_SECRET_KEY` environment variable.

apache cisa nuclei_scanner metasploit

CVSS scores

CVSS v3.1 8.9 High

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L

Exploitation status

Exploited in the wild

Recorded 2024-01-08 00:00:00 UTC · Source

SSVC decision points

Exploitation: active
Automatable: No
Technical impact: total

References

Known exploited vulnerability sources

Catalogues that list this CVE as a known exploited vulnerability.

Source	Added
CISA	Jan 08, 2024

Scanner integrations

Scanner	Reference	Detected
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/apache_superset_cookie_sig_rce.rb	Apr 28, 2025
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27524.yaml	Apr 25, 2025