CVE-2022-43721

EPSS 0.22%
Veröffentlicht 16.01.2023 11:15:10
Zuletzt bearbeitet 07.04.2025 15:15:41
Quelle security@apache.org
Teams Watchlist Login
Unerledigt Login

An authenticated attacker with update datasets permission could change a dataset link to an untrusted site, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 4

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Apache ≫ Superset Version <= 1.5.2

Apache ≫ Superset Version2.0.0 Update-

Apache ≫ Superset Version2.0.0 Updaterc1

Apache ≫ Superset Version2.0.0 Updaterc2

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.22%	0.443

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	5.4	2.3	2.7	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
134c704f-9b21-4f2e-91b3-4a467353bcc0	5.4	2.3	2.7	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

https://lists.apache.org/thread/s6sqt5jmcv6qxtvdot1t5tpt57v439kg

Vendor Advisory

Mailing List

https://nvd.nist.gov/vuln/detail/CVE-2022-43721

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2022-43721

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2022-43721

EUVD