CVE-2021-32609: XSS vulnerability on Explore page
Published Oct 18, 2021
·Updated
Apache Superset up to and including 1.1 does not sanitize titles correctly on the Explore page. This allows an attacker with Explore access to save a chart with a malicious title, injecting html (including scripts) into the page.
Affected Software
2 affected componentsFixes available
Apache Superset<=1.1
pip/apache-superset>=0<1.2.0
1.2.0
Event History
Oct 18, 2021
CVE Published
via MITRE·02:30 PM
Data Sourced
via MITRE·02:30 PM
DescriptionWeakness
May 24, 2022
Advisory Published
07:17 PM
Frequently Asked Questions
1
What is the severity of CVE-2021-32609?
The severity of CVE-2021-32609 is medium with a severity value of 5.4.
2
How does CVE-2021-32609 affect Apache Superset?
CVE-2021-32609 affects Apache Superset up to and including version 1.1.
3
What is the impact of CVE-2021-32609?
CVE-2021-32609 allows an attacker with Explore access to save a chart with a malicious title, injecting html (including scripts) into the page.
4
How can I fix CVE-2021-32609?
To fix CVE-2021-32609, upgrade to Apache Superset version 1.2 or later.
5
Is there any additional information about CVE-2021-32609?
Yes, you can find more information about CVE-2021-32609 at the following references: [link1], [link2], [link3].