Cross-Site Request Forgery (CSRF)

2023-01-1903:47:44

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

cross-site request forgery

http get method

core.py

redirect

malicious url

software

EPSS

0.005

Percentile

77.7%

JSON

apache-superset is vulnerable to Cross-Site Request Forgery (CSRF). The vulnerability exists due to the use of the HTTP GET method for the legacy REST API endpoints in the request_access and approve functions of core.py, allowing an attacker to redirect to the malicious URL through the GET request.