PT-2023-14307 · Apache · Apache Superset

Vladimir Razov · Publicado 2023-01-16 · Atualizado 2025-04-07 · CVE-2022-43721

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache Superset versions 1.5.2 and prior Apache Superset version 2.0.0

Description An authenticated attacker with update datasets permission could change a dataset link to an untrusted site. Users could be redirected to this site when clicking on that specific dataset.

Recommendations For Apache Superset versions 1.5.2 and prior, consider restricting the update datasets permission to trusted users until a patch is available. For Apache Superset version 2.0.0, consider restricting the update datasets permission to trusted users until a patch is available. As a temporary workaround, consider monitoring and validating dataset links to prevent redirection to untrusted sites.

Correção

Open Redirect

Enumeração de Fraquezas

CWE-601

Identificadores relacionados

BIT-SUPERSET-2022-43721

CVE-2022-43721

GHSA-FCG4-PM6H-9XX2

Produtos afetados

Apache Superset

Referências · 8

• https://github.com/apache/superset · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2022-43721 · Nota de Segurança
• https://osv.dev/vulnerability/BIT-superset-2022-43721 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2022-43721 · Aviso do Fabricante
• https://lists.apache.org/thread/s6sqt5jmcv6qxtvdot1t5tpt57v439kg · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-fcg4-pm6h-9xx2 · Aviso do Fabricante
• https://t.me/cvenotify/42078 · Publicação no Telegram
• https://t.me/cvenotify/118027 · Publicação no Telegram