Vulnerability · Published Mar 5, 2021 · Assigned by apache
CVE-2021-27907Apache Superset stored XSS on Dashboard markdown
Medium 5.4
In plain English
A medium-severity cross-site scripting in Apache Superset from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 86.4% (higher than 99.7% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Apache Superset up to and including 0.38.0 allowed the creation of a Markdown component on a Dashboard page for describing chart's related information. Abusing this functionality, a malicious user could inject javascript code executing unwanted action in the context of the user's browser. The javascript code will be automatically executed (Stored XSS) when a legitimate user surfs on the dashboard page. The vulnerability is exploitable creating a “div” section and embedding in it a “svg” element with javascript code.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | apache-superset | 0.38.1 | GHSA-w358-rj93-r5qv |
| PyPI | apache-superset | 0.38.1 | PYSEC-2021-127 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Superset | Apache Superset – through 0.38.0 |
Weakness: CWE-79