Apache Superset SQL Injection Vulnerability

A SQL injection vulnerability has been identified in Apache Superset versions prior to 6.0.0. This vulnerability allows an authenticated user with read access to perform error-based SQL injection through the sqlExpression or where parameters. The issue arises from improper neutralization of special elements used in SQL commands.

Impact

Exploitation of this vulnerability allows for error-based SQL injection, where an attacker can manipulate SQL queries to extract information from the database or potentially execute arbitrary SQL commands.

Remediation

Users are advised to upgrade to Apache Superset version 6.0.0 or later, which addresses this vulnerability.