BIT-superset-2022-43718

vendorUSosv

Apache Superset: Cross-Site Scripting vulnerability on upload forms

view advisory published 2025-02-05Licence: per source

Upload data forms do not correctly render user input leading to possible XSS attack vectors that can be performed by authenticated users with database connection update permissions. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-43718US	medium5.4	1.17% (67th)	—	2023-01-16
Upload data forms do not correctly render user input leading to possible XSS attack vectors that can be performed by authenticated users with database connection update permissions…

references

External citations — patches, advisories, analysis.

https://lists.apache.org/thread/8615608jt2x7b3rmqrtngldy8pn3nz2rADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2022-43718WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan