GitHub Advisoryadvisory · PyPI

GHSA-hc74-9vjm-c9xv Apache Superset Open Redirect vulnerability

MEDIUM Published 2023-11-28 Modified 2023-12-05 Official page ↗
Aliases
CVE-2023-42502
Ecosystem
PyPI
Packages
apache-superset
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-601
Reviewed
2023-11-28

Affected packages

• PyPI apache-superset: < 3.0.0 → fixed in 3.0.0

Description

An authenticated attacker with update datasets permission could change a dataset link to an untrusted site by spoofing the HTTP Host header, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset versions before 3.0.0.

Related

Alias · CVE (1)

  • CVE-2023-42502 An authenticated attacker with update datasets permission could change a dataset link to an untrusted site by spoofing the HTTP Host… vulnerability

Weakness · CWE (1)

  • CWE-601 URL Redirection to Untrusted Site weakness

References