CVE-2022-43721

EPSS 0.22%
Published 16.01.2023 11:15:10
Last modified 07.04.2025 15:15:41
Source security@apache.org
Teams watchlist Login
Open Login

An authenticated attacker with update datasets permission could change a dataset link to an untrusted site, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

Affected products Warnungen 0 Metrics 3 CWE 1 References 4

Data is provided by the National Vulnerability Database (NVD)

Apache ≫ Superset Version <= 1.5.2

Apache ≫ Superset Version2.0.0 Update-

Apache ≫ Superset Version2.0.0 Updaterc1

Apache ≫ Superset Version2.0.0 Updaterc2

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.22%	0.443

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	5.4	2.3	2.7	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
134c704f-9b21-4f2e-91b3-4a467353bcc0	5.4	2.3	2.7	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

https://lists.apache.org/thread/s6sqt5jmcv6qxtvdot1t5tpt57v439kg

Vendor Advisory

Mailing List

https://nvd.nist.gov/vuln/detail/CVE-2022-43721

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2022-43721

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2022-43721

EUVD