Vulnerability · Published Jan 16, 2023 · Assigned by apache
CVE-2022-43721Apache Superset: Open Redirect Vulnerability
Medium 5.4
In plain English
A medium-severity open redirect in Apache Superset from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)1.0%top 36.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An authenticated attacker with update datasets permission could change a dataset link to an untrusted site, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | apache-superset | no fix listed | GHSA-fcg4-pm6h-9xx2 |
| PyPI | apache-superset | no fix listed | GHSA-fcg4-pm6h-9xx2 |
| PyPI | apache-superset | 1.5.3, 2.0.1 | PYSEC-2026-781 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Superset | 2.0.0 – before 2.0.10 – through 1.5.2 |
Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
References
- https://lists.apache.org/thread/s6sqt5jmcv6qxtvdot1t5tpt57v439kg vendor-advisory