Apache Superset Cross-site Scripting (XSS) vulnerability on the Explore page
Apache Superset up to and including 1.1 does not sanitize titles correctly on the Explore page. This allows an attacker with Explore access to save a chart with a malicious title, injecting html (including scripts) into the page.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-32609US | medium5.4 | — | ||
Apache Superset up to and including 1.1 does not sanitize titles correctly on the Explore page. This allows an attacker with Explore access to save a chart with a malicious title,… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/advisories/GHSA-f8vc-f28w-x9c9ADVISORY
- https://github.com/apache/supersetWEB
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-superset/PYSEC-2021-377.yamlWEB
- https://lists.apache.org/thread.html/r2c09254e98b4f8b3deb422762bd0e2aa6d743b72d96c2f90cbaae31a%40%3Cdev.superset.apache.org%3EWEB
- https://nvd.nist.gov/vuln/detail/CVE-2021-32609ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan