GitHub Advisoryadvisory · PyPI

GHSA-9f88-wg5r-947j Apache Superset vulnerable to Cross-site Scripting

MEDIUM Published 2023-01-16 Modified 2023-01-24 Official page ↗
Aliases
CVE-2022-43717
Ecosystem
PyPI
Packages
apache-superset
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2023-01-20

Affected packages

• PyPI apache-superset: <= 1.5.2 (no fix yet) • PyPI apache-superset: 2.0.0 (no fix yet)

Description

Dashboard rendering does not sufficiently sanitize the content of markdown components leading to possible XSS attack vectors that can be performed by authenticated users with create dashboard permissions. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

Related

Alias · CVE (1)

  • CVE-2022-43717 Dashboard rendering does not sufficiently sanitize the content of markdown components leading to possible XSS attack vectors that can be… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References