PT-2023-14307 · Apache · Apache Superset

Vladimir Razov · Published 2023-01-16 · Updated 2025-04-07 · CVE-2022-43721

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache Superset versions 1.5.2 and prior Apache Superset version 2.0.0

Description An authenticated attacker with update datasets permission could change a dataset link to an untrusted site. Users could be redirected to this site when clicking on that specific dataset.

Recommendations For Apache Superset versions 1.5.2 and prior, consider restricting the update datasets permission to trusted users until a patch is available. For Apache Superset version 2.0.0, consider restricting the update datasets permission to trusted users until a patch is available. As a temporary workaround, consider monitoring and validating dataset links to prevent redirection to untrusted sites.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

BIT-SUPERSET-2022-43721

CVE-2022-43721

GHSA-FCG4-PM6H-9XX2

Affected Products

Apache Superset

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2022-43721 · Security Note
• https://osv.dev/vulnerability/BIT-superset-2022-43721 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-43721 · Vendor Advisory
• https://lists.apache.org/thread/s6sqt5jmcv6qxtvdot1t5tpt57v439kg · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fcg4-pm6h-9xx2 · Vendor Advisory
• https://github.com/apache/superset · Note
• https://t.me/cvenotify/42078 · Telegram Post
• https://t.me/cvenotify/118027 · Telegram Post