GitHub Advisoryadvisory · PyPI

GHSA-7222-r37x-8q3m Apache Superset vulnerable to Cross-Site Request Forgery via legacy REST API endpoints

HIGH Published 2023-01-16 Modified 2025-04-07 Official page ↗
Aliases
CVE-2022-43719
Ecosystem
PyPI
Packages
apache-superset
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-352
Reviewed
2023-01-20

Affected packages

• PyPI apache-superset: <= 1.5.2 (no fix yet) • PyPI apache-superset: 2.0.0 (no fix yet)

Description

Two legacy REST API endpoints for approval and request access are vulnerable to cross site request forgery. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

Related

Alias · CVE (1)

  • CVE-2022-43719 Two legacy REST API endpoints for approval and request access are vulnerable to cross site request forgery. vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References