PT-2023-28919 · Apache · Apache Superset

Nick Barnes · Publicado 2023-11-27 · Atualizado 2025-02-05 · CVE-2023-43701

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Superset versions prior to 2.1.2

Description The issue is caused by improper payload validation and an improper REST API response type. This allows an authenticated malicious actor to store malicious code into Chart's metadata. The code can be executed if a user accesses a specific deprecated API endpoint.

Recommendations For Apache Superset versions prior to 2.1.2, upgrade to version 2.1.2 to fix the issue. As a temporary workaround, consider restricting access to the deprecated API endpoint until the upgrade is applied.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BIT-SUPERSET-2023-43701

CVE-2023-43701

GHSA-WQ8Q-99P5-XFRW

Produtos afetados

Apache Superset

Referências · 11

• https://github.com/apache/superset · Nota
• https://osv.dev/vulnerability/GHSA-wq8q-99p5-xfrw · Aviso do Fabricante
• https://t.me/cvenotify/61227 · Publicação no Telegram
• https://lists.apache.org/thread/4dnr1knk50fw60jxkjgqj228f0xcc892 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-43701 · Aviso do Fabricante
• https://openwall.com/lists/oss-security/2023/11/27/4 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-43701 · Nota de Segurança
• https://t.me/cvenotify/61251 · Publicação no Telegram
• https://t.me/cvenotify/61233 · Publicação no Telegram
• http://openwall.com/lists/oss-security/2023/11/27/4 · Nota
• https://osv.dev/vulnerability/BIT-superset-2023-43701 · Aviso do Fabricante