CVE-2021-27907
CVE-2021-27907 · Apache Superset stored XSS on Dashboard markdown
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Apache Superset up to and including 0.38.0 allowed the creation of a Markdown component on a Dashboard page for describing chart's related information. Abusing this functionality, a malicious user could inject javascript code executing unwanted action in the context of the user's browser. The javascript code will be automatically executed (Stored XSS) when a legitimate user surfs on the dashboard page. The vulnerability is exploitable creating a “div” section and embedding in it a “svg” element with javascript code.
CVSS 5.4 · Media · EPSS 86,4% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: python
Productos y versiones afectados
apache superset
- Versiones
- ≥ Apache Superset, ≤ 0.38.0: Afectada (custom)
Sin corrección publicada
apache-superset PyPI
- Versiones
- 0.34.0
- 0.34.1
- 0.35.1
- 0.35.2
- 0.36.0
- 0.37.0
- 0.37.1
- 0.37.2
- 0.38.0
- Intervalos de versiones afectados
- ECOSYSTEM: < 0.38.1
Actualiza a 0.38.1