Lucene search
GoogleOSV:PYSEC-2021-128HistoryApr 27, 2021 - 10:15 a.m.
PYSEC-2021-128
2021-04-2710:15:00
Google
osv.dev
9
apache superset
version 1.0.1
external urls
open redirect
vulnerability
malicious user
dashboard
EPSS
0.004
Percentile
74.8%
Apache Superset up to and including 1.0.1 allowed for the creation of an external URL that could be malicious. By not checking user input for open redirects the URL shortener functionality would allow for a malicious user to create a short URL for a dashboard that could convince the user to click the link.
References
www.openwall.com/lists/oss-security/2021/04/27/2
github.com/advisories/GHSA-pfwg-rxf4-97c3
lists.apache.org/thread.html/r89b5d0dd35c1adc9624b48d6247729c73b2641b32754226661368434%40%3Cdev.superset.apache.org%3E
lists.apache.org/thread.html/r89b5d0dd35c1adc9624b48d6247729c73b2641b32754226661368434@%3Cdev.superset.apache.org%3E
Related
osv
osv
CVE-2021-28125
2021-04-27 10:15:09
Open Redirect in Apache Superset
2021-10-06 17:47:53
veracode
veracode
Open Redirection
2021-04-29 18:32:31
prion
prion
Open redirect
2021-04-27 10:15:00
cvelist
cvelist
CVE-2021-28125 Apache Superset Open Redirect
2021-04-27 09:27:22
github
github
Open Redirect in Apache Superset
2021-10-06 17:47:53
nvd
nvd
CVE-2021-28125
2021-04-27 10:15:09
cve
cve
CVE-2021-28125
2021-04-27 10:15:09