CVE-2023-42502

Apache Superset: Open Redirect Vulnerability

State: Published
Severity: 4.8 Medium
Published: Nov 28, 2023
Updated: Aug 2, 2024
Reserved: Sep 11, 2023

Description

An authenticated attacker with update datasets permission could change a dataset link to an untrusted site by spoofing the HTTP Host header, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset versions before 3.0.0.

Scores

CVSS	Score	Vector	Source
3.1	4.8 Medium	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N	apache

Weaknesses

CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

Affected Products

Product	Versions
Apache SupersetApache Software Foundation	before 3.0.0Affected

References

https://lists.apache.org/thread/n8348f194d8o8mln3oxd0s8jdl5bxbmnvendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.