VDB
CVE-2025-55674
CVE-2025-55674
PUBLISHED
CVSS 5.300000190734863 MEDIUM
A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue.
EPSS 0.69% · 53.0th percentile
Risk Scores
CVSS 4.0
5.300000190734863
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score
0.69%
53.0th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bitnami | superset | 0 |
| Bitnami | superset | 0 |
Timeline
- Aug 14, 2025 CVE Published
- Aug 14, 2025 PoC Published
- Aug 14, 2025 PoC Published
- Aug 14, 2025 PoC Published
- Aug 15, 2025 EPSS Score
- Aug 24, 2025 EPSS Score
- Sep 3, 2025 EPSS Score
- Sep 12, 2025 EPSS Score
- Sep 21, 2025 EPSS Score
- Sep 30, 2025 EPSS Score
- Oct 10, 2025 EPSS Score
- Oct 19, 2025 EPSS Score