CVE-2022-43718 Apache Superset: Cross-Site Scripting vulnerability on upload forms

2023-01-1610:10:04

CWE-79

apache

www.cve.org

apache superset

xss

vulnerability

cve-2022-43718

upload forms

cross-site scripting

authenticated users

database connection.

0.001 Low

EPSS

Percentile

32.8%

JSON

Upload data forms do not correctly render user input leading to possible XSS attack vectors that can be performed by authenticated users with database connection update permissions. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache Superset",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "2.0.1",
        "status": "affected",
        "version": "2.0.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "1.5.2",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

References

lists.apache.org/thread/8615608jt2x7b3rmqrtngldy8pn3nz2r

0.001 Low

EPSS

Percentile

32.8%

JSON

Related for CVELIST:CVE-2022-43718