CVE-2023-43701: Apache Superset: Stored XSS on API endpoint
Improper payload validation and an improper REST API response type, made it possible for an authenticated malicious actor to store malicious code into Chart's metadata, this code could get executed if a user specifically accesses a specific deprecated API endpoint. This issue affects Apache Superset versions prior to 2.1.2. Users are recommended to upgrade to version 2.1.2, which fixes this issue.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-43701?
CVE-2023-43701 is a vulnerability in Apache Superset that allows an authenticated malicious actor to store and execute malicious code through a specific deprecated API endpoint.
What is the severity of CVE-2023-43701?
The severity of CVE-2023-43701 is medium, with a CVSS v3.1 base score of 4.3.
How does CVE-2023-43701 affect Apache Superset?
CVE-2023-43701 affects Apache Superset and the vulnerable version is up to (but not including) version 2.1.2.
How can an authenticated actor exploit CVE-2023-43701?
An authenticated malicious actor can exploit CVE-2023-43701 by storing malicious code into Chart's metadata and accessing a specific deprecated API endpoint.
Is there a fix available for CVE-2023-43701?
Yes, the fix for CVE-2023-43701 is to upgrade Apache Superset to version 2.1.2 or higher.