[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ffl_zWwfjo2Y6G3uzh2ycS_GmYrISr5G0fIRAiY63r2w":3,"g5a-risk:CVE-2023-27524":153},{"success":4,"data":5,"meta":150},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":41,"epssPercentile":28,"epssTimeSeries":42,"severity":44,"affectedProducts":45,"affectedProductsCount":51,"references":52,"referencesCount":86,"weaknesses":87,"weaknessesCount":51,"isActivelyExploited":4,"cisaInfo":96,"otxData":28,"relatedBlogPosts":98,"seoMetadata":99,"configurations":124,"relatedVendorCves":134,"notableEvents":135},"CVE-2023-27524","What is CVE-2023-27524?","Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config.\n\nAll superset installations should always set a unique secure random SECRET_KEY. Your SECRET_KEY is used to securely sign all session cookies and encrypting sensitive information on the database.\nAdd a strong SECRET_KEY to your `superset_config.py` file like:\n\nSECRET_KEY = \n\nAlternatively you can set it with `SUPERSET_SECRET_KEY` environment variable.","Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY accor...","2023-04-24T16:15:07.843","2025-10-23T14:49:38.817",9.8,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"CVSSMetricV31":15,"CVSSMetricV30":39,"CVSSMetricV2":40,"CVSSMetricV40":28},[16,31],{"Source":17,"Type":18,"CVSSData":19,"ExploitabilityScore":29,"ImpactScore":30},"security@apache.org","Secondary",{"Version":20,"VectorString":21,"AttackVector":22,"AttackComplexity":23,"PrivilegesRequired":24,"UserInteraction":24,"Scope":25,"ConfidentialityImpact":23,"IntegrityImpact":23,"AvailabilityImpact":26,"BaseScore":27,"BaseSeverity":23,"ExploitCodeMaturity":28,"RemediationLevel":28,"ReportConfidence":28,"TemporalScore":28,"TemporalSeverity":28,"ConfidentialityRequirement":28,"IntegrityRequirement":28,"AvailabilityRequirement":28,"ModifiedAttackVector":28,"ModifiedAttackComplexity":28,"ModifiedPrivilegesRequired":28,"ModifiedUserInteraction":28,"ModifiedScope":28,"ModifiedConfidentialityImpact":28,"ModifiedIntegrityImpact":28,"ModifiedAvailabilityImpact":28,"EnvironmentalScore":28,"EnvironmentalSeverity":28},"3.1","CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:C\u002FC:H\u002FI:H\u002FA:L","NETWORK","HIGH","NONE","CHANGED","LOW",8.9,null,2.2,6,{"Source":32,"Type":33,"CVSSData":34,"ExploitabilityScore":37,"ImpactScore":38},"nvd@nist.gov","Primary",{"Version":20,"VectorString":13,"AttackVector":22,"AttackComplexity":26,"PrivilegesRequired":24,"UserInteraction":24,"Scope":35,"ConfidentialityImpact":23,"IntegrityImpact":23,"AvailabilityImpact":23,"BaseScore":12,"BaseSeverity":36,"ExploitCodeMaturity":28,"RemediationLevel":28,"ReportConfidence":28,"TemporalScore":28,"TemporalSeverity":28,"ConfidentialityRequirement":28,"IntegrityRequirement":28,"AvailabilityRequirement":28,"ModifiedAttackVector":28,"ModifiedAttackComplexity":28,"ModifiedPrivilegesRequired":28,"ModifiedUserInteraction":28,"ModifiedScope":28,"ModifiedConfidentialityImpact":28,"ModifiedIntegrityImpact":28,"ModifiedAvailabilityImpact":28,"EnvironmentalScore":28,"EnvironmentalSeverity":28},"UNCHANGED","CRITICAL",3.9,5.9,[],[],0.98148,[43,43,43,43,41,41,41],0.97405,"Critical",[46],{"vendor":47,"product":48,"version":49,"criteria":50,"vulnerable":4},"apache","superset","*","cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:*",1,[53,59,66,69,73,75,77,79,81],{"url":54,"source":55,"tags":56},"https:\u002F\u002Flists.apache.org\u002Fthread\u002Fn0ftx60sllf527j7g11kmt24wvof8xyk","Apache",[57,58],"Mailing List","Vendor Advisory",{"url":60,"source":61,"tags":62},"https:\u002F\u002Fpacketstormsecurity.com\u002Ffiles\u002F172522\u002FApache-Superset-2.0.0-Authentication-Bypass.html","Packetstormsecurity",[63,64,65],"Exploit","Third Party Advisory","VDB Entry",{"url":67,"source":61,"tags":68},"https:\u002F\u002Fpacketstormsecurity.com\u002Ffiles\u002F175094\u002FApache-Superset-2.0.0-Remote-Code-Execution.html",[63,64,65],{"url":70,"source":71,"tags":72},"https:\u002F\u002Fwww.openwall.com\u002Flists\u002Foss-security\u002F2023\u002F04\u002F24\u002F2","Openwall",[57],{"url":54,"source":55,"tags":74},[57,58],{"url":60,"source":61,"tags":76},[63,64,65],{"url":67,"source":61,"tags":78},[63,64,65],{"url":70,"source":71,"tags":80},[57],{"url":82,"source":83,"tags":84},"https:\u002F\u002Fwww.cisa.gov\u002Fknown-exploited-vulnerabilities-catalog?field_cve=CVE-2023-27524","CISA",[64,85],"US Government Resource",9,[88],{"id":89,"name":90,"description":91,"extendedDescription":92,"status":93,"abstraction":94,"structure":95},"CWE-1188","Initialization of a Resource with an Insecure Default","The product initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure.","Developers often choose default values that leave the product as open and easy to use as possible out-of-the-box, under the assumption that the administrator can (or should) change the default value.  However, this ease-of-use comes at a cost when the default is insecure and the administrator does not change it.","Incomplete","Base","Simple",{"shortDescription":97,"requiredAction":97,"vulnerabilityName":97,"dateAdded":28},"",[],{"title":100,"metaDescription":101,"keywords":102,"canonicalUrl":103,"structuredData":104},"What is CVE-2023-27524? Vulnerability Analysis | Security Advisory | EdgeProtect","Comprehensive analysis of CVE-2023-27524, a critical severity cyber security vulnerability from 2023. High exploit probability (98.1%). Session Validation at...","CVE-2023-27524, CVE-2023-27524 vulnerability, CVE-2023-27524 security, critical severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2023, CVSS score, exploit, patch, remediation, apache security, superset vulnerability, high risk vulnerability, actively exploited, exploit available","\u002Fwhat-is\u002Fcve-2023-27524",{"@context":105,"@type":106,"headline":100,"description":101,"datePublished":10,"dateModified":11,"author":107,"publisher":111,"about":115,"mainEntityOfPage":119,"articleSection":122,"keywords":123},"https:\u002F\u002Fschema.org","TechArticle",{"@type":108,"name":109,"url":110},"Organization","EdgeProtect","https:\u002F\u002Fedgeprotect.io",{"@type":108,"name":109,"url":110,"logo":112},{"@type":113,"url":114},"ImageObject","https:\u002F\u002Fedgeprotect.io\u002Fimg\u002Flogos\u002Fedgeprotect-logo-512.png",{"@type":116,"name":6,"description":117,"additionalType":118},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":120,"@id":121},"WebPage","https:\u002F\u002Fedgeprotect.io\u002Fwhat-is\u002Fcve-2023-27524","Cybersecurity","CVE-2023-27524, CVE-2023-27524 vulnerability, CVE-2023-27524 security, critical severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[125],{"Operator":28,"Negate":28,"Nodes":126},[127],{"Operator":128,"Negate":129,"CPEMatch":130},"OR",false,[131],{"Vulnerable":4,"Criteria":50,"MatchCriteriaID":132,"VersionStartExcluding":28,"VersionStartIncluding":28,"VersionEndExcluding":28,"VersionEndIncluding":133},"20E98F0D-B484-4FA4-8273-074A75ED3227","2.0.1",[],[136,143],{"id":137,"eventType":138,"eventTime":139,"details":140,"label":141,"color":142},"e98f7797-05cb-4b32-af4a-9be28f5d22e8","LOW_EPSS_DELTA","2025-06-11T10:10:20.448763+00:00","Daily EPSS score decreased by 0.133 on 2023-12-30","EPSS Score Decreased","green",{"id":144,"eventType":145,"eventTime":146,"details":147,"label":148,"color":149},"21715271-efe1-4282-9208-c57ce472fcf6","HIGH_EPSS_DELTA","2026-06-16T04:05:08.858752+00:00","Daily EPSS score increased by 0.134 on 2023-12-30","EPSS Score Increased","red",{"lastModified":11,"cacheTime":151,"version":152},1793226071781,"2.0",{"score":154,"band":44,"action":155,"scoredAt":156},89,"Emergency patch","2026-10-28T06:57:19.159076+00:00"]