p PatchFirst

CVE-2021-27907

CVE-2021-27907 · Apache Superset stored XSS on Dashboard markdown

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Apache Superset up to and including 0.38.0 allowed the creation of a Markdown component on a Dashboard page for describing chart's related information. Abusing this functionality, a malicious user could inject javascript code executing unwanted action in the context of the user's browser. The javascript code will be automatically executed (Stored XSS) when a legitimate user surfs on the dashboard page. The vulnerability is exploitable creating a “div” section and embedding in it a “svg” element with javascript code.

CVSS 5.4 · Medium · EPSS 86.4% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • apache superset

    Versions
    • ≥ Apache Superset, ≤ 0.38.0: Affected (custom)

    No fix published

  • apache-superset PyPI

    Versions
    • 0.34.0
    • 0.34.1
    • 0.35.1
    • 0.35.2
    • 0.36.0
    • 0.37.0
    • 0.37.1
    • 0.37.2
    • 0.38.0
    Affected ranges
    • ECOSYSTEM: < 0.38.1

    Update to 0.38.1

Original sources

Check your server →