CVE-2023-42502

2023-11-2817:15:07

Google

osv.dev

authenticated

attacker

dataset

untrusted site

apache superset

versions

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

28.2%

JSON

An authenticated attacker with update datasets permission could change a dataset link to an untrusted site by spoofing the HTTP Host header, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset versions before 3.0.0.

CPENameOperatorVersion
superseteq2021.9.0
superseteq0.8.7
superseteqairbnb_prod.0.11.0.5
superseteqairbnb_prod.0.15.4.1
superseteq2020.51.0
superseteqairbnb_prod.0.11.0.4
superseteqsuperset-helm-chart-0.3.4
superseteqsuperset-helm-chart-0.8.3
superseteqsuperset-helm-chart-0.5.8
superseteqsuperset-helm-chart-0.3.11

Name	Operator	Version
superset	eq	2021.9.0
superset	eq	0.8.7
superset	eq	airbnb_prod.0.11.0.5
superset	eq	airbnb_prod.0.15.4.1
superset	eq	2020.51.0
superset	eq	airbnb_prod.0.11.0.4
superset	eq	superset-helm-chart-0.3.4
superset	eq	superset-helm-chart-0.8.3
superset	eq	superset-helm-chart-0.5.8
superset	eq	superset-helm-chart-0.3.11