[apache-superset] Apache Superset has Improper Access Control

When explicitly enabling the feature flag DASHBOARD_CACHE (disabled by default), the system allowed for an unauthenticated user to access dashboard configuration metadata using a REST API Get endpoint. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-45438
• https://lists.apache.org/thread/snxbkf2x9kww7s0wkmydct9nhqqn9rv9
• https://github.com/advisories/GHSA-8f5j-mgx9-5hm5