GitHub Advisoryadvisory · PyPI

GHSA-79x5-cv79-49rj Apache Superset is vulnerable to Cross-Site Scripting (XSS)

MEDIUM Published 2023-01-16 Modified 2025-04-07 Official page ↗
Aliases
CVE-2022-43718
Ecosystem
PyPI
Packages
apache-superset
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2023-01-19

Affected packages

• PyPI apache-superset: <= 1.5.2 (no fix yet) • PyPI apache-superset: 2.0.0 (no fix yet)

Description

Upload data forms do not correctly render user input leading to possible XSS attack vectors that can be performed by authenticated users with database connection update permissions. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

Related

Alias · CVE (1)

  • CVE-2022-43718 Upload data forms do not correctly render user input leading to possible XSS attack vectors that can be performed by authenticated users… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References