{"action":"Upgrade apache-superset to 2.1.0 or later.","affected":[{"fixed":"2.1.0","introduced":"0"}],"component":"apache-superset","cve_ids":["CVE-2023-27524"],"ecosystem":"PyPI","epss":0.98148,"exploited":true,"fixed_versions":["2.1.0"],"ghsa_id":"GHSA-5cx2-vq3h-x52c","id":"tcs_01M5KF0RQVYEC1GR37DCBE2A0S","modified_at":"2026-07-07T17:56:24.545479431Z","published_at":"2023-04-24T18:30:30Z","references":["https://osv.dev/vulnerability/GHSA-5cx2-vq3h-x52c","https://nvd.nist.gov/vuln/detail/CVE-2023-27524","https://github.com/apache/superset/commit/b180319bbf08e876ea84963220ebebbfd0699e03","https://github.com/apache/superset","https://lists.apache.org/thread/n0ftx60sllf527j7g11kmt24wvof8xyk","https://packetstormsecurity.com/files/172522/Apache-Superset-2.0.0-Authentication-Bypass.html","https://packetstormsecurity.com/files/175094/Apache-Superset-2.0.0-Remote-Code-Execution.html","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-27524","https://www.openwall.com/lists/oss-security/2023/04/24/2","http://www.openwall.com/lists/oss-security/2023/04/24/2"],"severity":{"label":"high","score":8.9},"sources":[{"source":"osv","source_id":"GHSA-5cx2-vq3h-x52c","url":"https://osv.dev/vulnerability/GHSA-5cx2-vq3h-x52c"},{"source":"kev","source_id":"CVE-2023-27524","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}],"summary":"Apache superset missing check for default SECRET_KEY"}