GitHub Advisoryadvisory · PyPI

GHSA-fcg4-pm6h-9xx2 Apache Superset Open Redirect vulnerability

MEDIUM Published 2023-01-16 Modified 2025-04-07 Official page ↗
Aliases
CVE-2022-43721
Ecosystem
PyPI
Packages
apache-superset
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-601
Reviewed
2023-01-20

Affected packages

• PyPI apache-superset: <= 1.5.2 (no fix yet) • PyPI apache-superset: 2.0.0 (no fix yet)

Description

An authenticated attacker with update datasets permission could change a dataset link to an untrusted site, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

Related

Alias · CVE (1)

  • CVE-2022-43721 An authenticated attacker with update datasets permission could change a dataset link to an untrusted site, users could be redirected to… vulnerability

Weakness · CWE (1)

  • CWE-601 URL Redirection to Untrusted Site weakness

References