GHSA-79x5-cv79-49rj

ghsaUSosv

Apache Superset is vulnerable to Cross-Site Scripting (XSS)

view advisory published 2023-01-16Licence: CC-BY-4.0

Upload data forms do not correctly render user input leading to possible XSS attack vectors that can be performed by authenticated users with database connection update permissions. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-43718US	medium5.4	1.17% (67th)	—	2023-01-16
Upload data forms do not correctly render user input leading to possible XSS attack vectors that can be performed by authenticated users with database connection update permissions…

references

External citations — patches, advisories, analysis.

https://github.com/apache/supersetPACKAGE
https://lists.apache.org/thread/8615608jt2x7b3rmqrtngldy8pn3nz2rWEB
https://nvd.nist.gov/vuln/detail/CVE-2022-43718ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan