From 0b5baf73365b953802fc8a60821b249eefcb1a83 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Thu, 20 Jun 2024 16:16:59 +0000
Subject: [PATCH] Publish Advisories

GHSA-hcr7-cqwc-q5gq
GHSA-hcr7-cqwc-q5gq
---
 .../GHSA-hcr7-cqwc-q5gq.json                  | 88 +++++++++++++++++++
 .../GHSA-hcr7-cqwc-q5gq.json                  | 42 ---------
 2 files changed, 88 insertions(+), 42 deletions(-)
 create mode 100644 advisories/github-reviewed/2024/06/GHSA-hcr7-cqwc-q5gq/GHSA-hcr7-cqwc-q5gq.json
 delete mode 100644 advisories/unreviewed/2024/06/GHSA-hcr7-cqwc-q5gq/GHSA-hcr7-cqwc-q5gq.json

diff --git a/advisories/github-reviewed/2024/06/GHSA-hcr7-cqwc-q5gq/GHSA-hcr7-cqwc-q5gq.json b/advisories/github-reviewed/2024/06/GHSA-hcr7-cqwc-q5gq/GHSA-hcr7-cqwc-q5gq.json
new file mode 100644
index 00000000000..82dccaf7884
--- /dev/null
+++ b/advisories/github-reviewed/2024/06/GHSA-hcr7-cqwc-q5gq/GHSA-hcr7-cqwc-q5gq.json
@@ -0,0 +1,88 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-hcr7-cqwc-q5gq",
+  "modified": "2024-06-20T16:15:09Z",
+  "published": "2024-06-20T09:30:59Z",
+  "aliases": [
+    "CVE-2024-34693"
+  ],
+  "summary": "Apache Superset server arbitrary file read ",
+  "details": "Improper Input Validation vulnerability in Apache Superset, allows for an authenticated attacker to create a MariaDB connection with local_infile enabled. If both the MariaDB server (off by default) and the local mysql client on the web server are set to allow for local infile, it's possible for the attacker to execute a specific MySQL/MariaDB SQL command that is able to read files from the server and insert their content on a MariaDB database table. This issue affects Apache Superset before version 3.1.3 and in version 4.0.0.\n\nUsers are recommended to upgrade to version 4.0.1 or 3.1.3, both of which fix the issue.\n\n",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "apache-superset"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "3.1.3"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "apache-superset"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "4.0.0"
+            },
+            {
+              "fixed": "4.0.1"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34693"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/apache/superset"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.apache.org/thread/1803x1s34m7r71h1k0q1njol8k6fmyon"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2024/06/20/1"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-20"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-06-20T16:15:09Z",
+    "nvd_published_at": "2024-06-20T09:15:11Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/06/GHSA-hcr7-cqwc-q5gq/GHSA-hcr7-cqwc-q5gq.json b/advisories/unreviewed/2024/06/GHSA-hcr7-cqwc-q5gq/GHSA-hcr7-cqwc-q5gq.json
deleted file mode 100644
index 79705e66fa2..00000000000
--- a/advisories/unreviewed/2024/06/GHSA-hcr7-cqwc-q5gq/GHSA-hcr7-cqwc-q5gq.json
+++ /dev/null
@@ -1,42 +0,0 @@
-{
-  "schema_version": "1.4.0",
-  "id": "GHSA-hcr7-cqwc-q5gq",
-  "modified": "2024-06-20T12:31:19Z",
-  "published": "2024-06-20T09:30:59Z",
-  "aliases": [
-    "CVE-2024-34693"
-  ],
-  "details": "Improper Input Validation vulnerability in Apache Superset, allows for an authenticated attacker to create a MariaDB connection with local_infile enabled. If both the MariaDB server (off by default) and the local mysql client on the web server are set to allow for local infile, it's possible for the attacker to execute a specific MySQL/MariaDB SQL command that is able to read files from the server and insert their content on a MariaDB database table.This issue affects Apache Superset: before 3.1.3 and version 4.0.0\n\nUsers are recommended to upgrade to version 4.0.1 or 3.1.3, which fixes the issue.\n\n",
-  "severity": [
-    {
-      "type": "CVSS_V3",
-      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N"
-    }
-  ],
-  "affected": [
-
-  ],
-  "references": [
-    {
-      "type": "ADVISORY",
-      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34693"
-    },
-    {
-      "type": "WEB",
-      "url": "https://lists.apache.org/thread/1803x1s34m7r71h1k0q1njol8k6fmyon"
-    },
-    {
-      "type": "WEB",
-      "url": "http://www.openwall.com/lists/oss-security/2024/06/20/1"
-    }
-  ],
-  "database_specific": {
-    "cwe_ids": [
-      "CWE-20"
-    ],
-    "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
-    "nvd_published_at": "2024-06-20T09:15:11Z"
-  }
-}
\ No newline at end of file