What is CVE-2023-43701?

CVE-2023-43701 is a vulnerability in Apache Superset that allows an authenticated malicious actor to store and execute malicious code through a specific deprecated API endpoint.

What is the severity of CVE-2023-43701?

The severity of CVE-2023-43701 is medium, with a CVSS v3.1 base score of 4.3.

How does CVE-2023-43701 affect Apache Superset?

CVE-2023-43701 affects Apache Superset and the vulnerable version is up to (but not including) version 2.1.2.

How can an authenticated actor exploit CVE-2023-43701?

An authenticated malicious actor can exploit CVE-2023-43701 by storing malicious code into Chart's metadata and accessing a specific deprecated API endpoint.

Is there a fix available for CVE-2023-43701?

Yes, the fix for CVE-2023-43701 is to upgrade Apache Superset to version 2.1.2 or higher.

Vulnerability/
CVE-2023-43701

medium

5.4

CWE

27/11/2023

1/12/2023

CVE-2023-43701: Apache Superset: Stored XSS on API endpoint

First published: Mon Nov 27 2023(Updated: )

Improper payload validation and an improper REST API response type, made it possible for an authenticated malicious actor to store malicious code into Chart's metadata, this code could get executed if a user specifically accesses a specific deprecated API endpoint. This issue affects Apache Superset versions prior to 2.1.2. Users are recommended to upgrade to version 2.1.2, which fixes this issue.

Credit: security@apache.org security@apache.org

Affected Software	Affected Version	How to fix
pip/apache-superset	<2.1.2	2.1.2
Apache Superset	<2.1.2

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is CVE-2023-43701?
CVE-2023-43701 is a vulnerability in Apache Superset that allows an authenticated malicious actor to store and execute malicious code through a specific deprecated API endpoint.
What is the severity of CVE-2023-43701?
The severity of CVE-2023-43701 is medium, with a CVSS v3.1 base score of 4.3.
How does CVE-2023-43701 affect Apache Superset?
CVE-2023-43701 affects Apache Superset and the vulnerable version is up to (but not including) version 2.1.2.
How can an authenticated actor exploit CVE-2023-43701?
An authenticated malicious actor can exploit CVE-2023-43701 by storing malicious code into Chart's metadata and accessing a specific deprecated API endpoint.
Is there a fix available for CVE-2023-43701?
Yes, the fix for CVE-2023-43701 is to upgrade Apache Superset to version 2.1.2 or higher.

collector/oss-sec
alias/CVE-2023-43701
collector/github-advisory-latest
alias/GHSA-wq8q-99p5-xfrw
collector/mitre-cve
collector/nvd-api
collector/nvd-cve
collector/github-advisory
agent/author
agent/type
agent/last-modified-date
agent/softwarecombine
agent/first-publish-date
agent/weakness
agent/references
agent/title
agent/severity
agent/tags
agent/description
agent/event
agent/trending
package-manager/pip
vendor/apache
canonical/apache superset

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.