GitHub Advisoryadvisory · PyPI

GHSA-pfwg-rxf4-97c3 Open Redirect in Apache Superset

MEDIUM Published 2021-10-06 Modified 2022-06-01 Official page ↗
Aliases
CVE-2021-28125
Ecosystem
PyPI
Packages
superset, apache-superset
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-601
Reviewed
2021-10-06

Affected packages

• PyPI superset: <= 0.34.0 (no fix yet) • PyPI apache-superset: < 1.1.0 → fixed in 1.1.0

Description

Apache Superset prior to 1.1.0 allowed for the creation of an external URL that could be malicious. By not checking user input for open redirects the URL shortener functionality would allow for a malicious user to create a short URL for a dashboard that could convince the user to click the link.

Related

Alias · CVE (1)

  • CVE-2021-28125 Apache Superset up to and including 1.0.1 allowed for the creation of an external URL that could be malicious. vulnerability

Weakness · CWE (1)

  • CWE-601 URL Redirection to Untrusted Site weakness

References