PT-2025-33271 · Apache · Apache Superset

Jobar + 2 · Publicado 2025-08-13 · Atualizado 2025-08-18 · CVE-2025-55672

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Apache Superset versions prior to 5.0.0

Description: A stored Cross-Site Scripting (XSS) issue exists in the chart visualization feature. An authenticated user with chart editing permissions can inject a malicious payload into a column's label. This payload is not properly sanitized and is executed in the victim's browser when hovering over the chart, potentially leading to session hijacking or the execution of arbitrary commands on behalf of the user.

Recommendations: Upgrade to version 5.0.0.

Correção

XSS

Enumeração de Fraquezas

CWE-80

Identificadores relacionados

BDU:2025-10093

BIT-SUPERSET-2025-55672

CVE-2025-55672

GHSA-FJ97-2V9X-W5M4

Produtos afetados

Apache Superset

Referências · 11

• https://github.com/apache/superset · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-55672 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-fj97-2v9x-w5m4 · Aviso do Fabricante
• https://lists.apache.org/thread/rvh7fdjfzxzjhcfwoz7twc2brhvochdj · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1956021913689497952 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-55672 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2025/08/14/4 · Nota
• https://osv.dev/vulnerability/BIT-superset-2025-55672 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2025-55672 · Nota de Segurança
• https://bdu.fstec.ru/vul/2025-10093 · Nota de Segurança
• https://twitter.com/oss_security/status/1956543481024848178 · Publicação no Twitter