CVE-2018-8021: Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to possible remote code execution

Critical severity · published Nov 7, 2018

CVE-2018-8021

Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to possible remote code execution

9.8

CVSS

53.4%

EPSS

On KEV

Description

Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to possible remote code execution. Note Superset 0.23 was released prior to any Superset release under the Apache Software Foundation.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)53.4% · higher than 99% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Superset · Apache

before 0.23 · source: NVD

Affected product

Superset

Apache

All Superset CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2018-8021

CVE.org

https://www.cve.org/CVERecord?id=CVE-2018-8021

Patch

https://github.com/apache/incubator-superset/pull/4243

Exploit

https://www.exploit-db.com/exploits/45933/