漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Apache Superset: Sensitive Data Exposure via REST API (disabled by default)
Vulnerability Description
A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default)
CVSS Information
N/A
Vulnerability Type
信息暴露
Vulnerability Title
Apache Superset 安全漏洞
Vulnerability Description
Apache Superset是美国阿帕奇（Apache）基金会的一个数据可视化和数据探索平台。 Apache Superset 6.0.0之前版本存在安全漏洞，该漏洞源于Tag端点序列化不当，可能导致经过身份验证的低权限用户检索敏感用户信息。
CVSS Information
N/A
Vulnerability Type
N/A