Vulnerability · Published Jan 16, 2023 · Assigned by apache

CVE-2022-43720Apache Superset: Improper rendering of user input

Medium 5.4

In plain English

A medium-severity injection in Apache Superset from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)1.3%top 29.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An authenticated attacker with write CSS template permissions can create a record with specific HTML tags that will not get properly escaped by the toast message displayed when a user deletes that specific CSS template record. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	apache-superset	no fix listed	GHSA-fpmr-qmgh-42x2
PyPI	apache-superset	no fix listed	GHSA-fpmr-qmgh-42x2
PyPI	apache-superset	1.5.3, 2.0.1	PYSEC-2026-782

Affected products (as reported)

Vendor	Product	Versions
Apache Software Foundation	Apache Superset	2.0.0 – before 2.0.10 – through 1.5.2

Weakness: CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References

https://lists.apache.org/thread/jts6x56kghr9mbowb653bk70pl81jp8l vendor-advisory