BIT-superset-2022-43717

vendorUSosv

Apache Superset: Cross-Site Scripting on dashboards

view advisory published 2025-02-05Licence: per source

Dashboard rendering does not sufficiently sanitize the content of markdown components leading to possible XSS attack vectors that can be performed by authenticated users with create dashboard permissions. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-43717US	medium5.4	1.29% (70th)	—	2023-01-16
Dashboard rendering does not sufficiently sanitize the content of markdown components leading to possible XSS attack vectors that can be performed by authenticated users with creat…

references

External citations — patches, advisories, analysis.

https://lists.apache.org/thread/g6zy6vkpvkbj5mj32vmyzwol5ldtg9plADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2022-43717WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan