PT-2023-28919 · Apache · Apache Superset

Nick Barnes · Published 2023-11-27 · Updated 2025-02-05 · CVE-2023-43701

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Superset versions prior to 2.1.2

Description The issue is caused by improper payload validation and an improper REST API response type. This allows an authenticated malicious actor to store malicious code into Chart's metadata. The code can be executed if a user accesses a specific deprecated API endpoint.

Recommendations For Apache Superset versions prior to 2.1.2, upgrade to version 2.1.2 to fix the issue. As a temporary workaround, consider restricting access to the deprecated API endpoint until the upgrade is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-SUPERSET-2023-43701

CVE-2023-43701

GHSA-WQ8Q-99P5-XFRW

Affected Products

Apache Superset

References · 11

• https://osv.dev/vulnerability/GHSA-wq8q-99p5-xfrw · Vendor Advisory
• https://lists.apache.org/thread/4dnr1knk50fw60jxkjgqj228f0xcc892 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-43701 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-43701 · Security Note
• https://osv.dev/vulnerability/BIT-superset-2023-43701 · Vendor Advisory
• https://github.com/apache/superset · Note
• https://t.me/cvenotify/61227 · Telegram Post
• https://openwall.com/lists/oss-security/2023/11/27/4 · Note
• https://t.me/cvenotify/61251 · Telegram Post
• https://t.me/cvenotify/61233 · Telegram Post
• http://openwall.com/lists/oss-security/2023/11/27/4 · Note