CVE-2022-43717

Apache Superset: Cross-Site Scripting on dashboards

CVSS 5.4 MEDIUMEPSS 1.2%CWE-79

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 5.4EPSS 1.2%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Lifecycle

16 Jan 2023Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Dashboard rendering does not sufficiently sanitize the content of markdown components leading to possible XSS attack vectors that can be performed by authenticated users with create dashboard permissions. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected products

Apache Software Foundation · Apache Superset

References

https://lists.apache.org/thread/g6zy6vkpvkbj5mj32vmyzwol5ldtg9pl