PT-2021-17758 · Apache · Apache Superset

Dario Castrogiovanni + 1 · Published 2021-04-27 · Updated 2025-02-05 · CVE-2021-28125

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Apache Superset versions prior to 1.1.0

Description: The issue allows for the creation of an external URL that could be malicious. By not checking user input for open redirects, the URL shortener functionality would allow for a malicious user to create a short URL for a dashboard that could convince the user to click the link.

Recommendations: For versions prior to 1.1.0, update to version 1.1.0 or later to resolve the issue. As a temporary workaround, consider disabling the URL shortener functionality until a patch is available. Restrict access to the URL shortener module to minimize the risk of exploitation. Avoid using the URL shortener functionality for dashboards until the issue is resolved.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

BIT-SUPERSET-2021-28125

CVE-2021-28125

GHSA-PFWG-RXF4-97C3

PYSEC-2021-128

Affected Products

Apache Superset

References · 14

• https://osv.dev/vulnerability/BIT-superset-2021-28125 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pfwg-rxf4-97c3 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-128 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-28125 · Security Note
• https://osv.dev/vulnerability/CVE-2021-28125 · Vendor Advisory
• https://github.com/apache/superset · Note
• https://github.com/apache/superset/commit/eb35b804acf4d84cb70d02743e04b8afebbee029 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-superset/PYSEC-2021-128.yaml · Note
• https://lists.apache.org/thread.html/r89b5d0dd35c1adc9624b48d6247729c73b2641b32754226661368434@%3Cdev.superset.apache.org%3E · Note
• https://t.me/cvenotify/14285 · Telegram Post
• https://lists.apache.org/thread.html/r89b5d0dd35c1adc9624b48d6247729c73b2641b32754226661368434%40%3Cdev.superset.apache.org%3E · Note
• https://t.me/cvenotify/13789 · Telegram Post
• https://github.com/advisories/GHSA-pfwg-rxf4-97c3 · Note
• http://openwall.com/lists/oss-security/2021/04/27/2 · Note