CVE-2022-43721: Apache Superset: Open Redirect Vulnerability
Published Jan 16, 2023
·Updated
An authenticated attacker with update datasets permission could change a dataset link to an untrusted site, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.
Affected Software
4 affected components
Apache Superset<=1.5.2
Apache Superset=2.0.0
Apache Superset=2.0.0-rc1
Apache Superset=2.0.0-rc2
Event History
Jan 16, 2023
CVE Published
via MITRE·10:10 AM
Data Sourced
via MITRE·10:10 AM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability identifier for this issue?
The vulnerability identifier for this issue is CVE-2022-43721.
2
What is the severity level of CVE-2022-43721?
The severity level of CVE-2022-43721 is medium.
3
Which software versions are affected by CVE-2022-43721?
Apache Superset version 1.5.2 and prior versions, as well as version 2.0.0, are affected by CVE-2022-43721.
4
How can an attacker exploit CVE-2022-43721?
An authenticated attacker with update datasets permission could change a dataset link to an untrusted site, redirecting users to that site when clicking on the dataset.
5
Is there a fix available for CVE-2022-43721?
Yes, updating to Apache Superset version 2.0.1 or later resolves the vulnerability.