CVE-2022-43718

Apache Superset: Cross-Site Scripting vulnerability on upload forms

CVSS 5.4 MEDIUMEPSS 1.3%CWE-79

Vexday Risk Score

13Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 5.4EPSS 1.3%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Ciclo de vida

16 jan 2023Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

Upload data forms do not correctly render user input leading to possible XSS attack vectors that can be performed by authenticated users with database connection update permissions. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Produtos afetados

Apache Software Foundation · Apache Superset

Referências

https://lists.apache.org/thread/8615608jt2x7b3rmqrtngldy8pn3nz2r