CVE-2018-8021 EXPLOIT
9.8
CRITICAL · CVSS 3.0 · EPSS 52.8% (pctl 99)
Patch early
A public exploit exists.
Description
Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to possible remote code execution. Note Superset 0.23 was released prior to any Superset release under the Apache Software Foundation.
Scoring
| CVSS | 9.8 (CRITICAL, v3.0) |
|---|---|
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 52.76% — more likely to be exploited than 99% of all CVEs |
| Weakness | CWE-502 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2018-11-07 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| apache | superset |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Apache Superset < 0.23 - Remote Code Execution | 2018-12-03 |
References
→ the Explorer · watch your stack · NVD