p PatchFirst

CVE-2021-28125

CVE-2021-28125 · Apache Superset Open Redirect

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Apache Superset up to and including 1.0.1 allowed for the creation of an external URL that could be malicious. By not checking user input for open redirects the URL shortener functionality would allow for a malicious user to create a short URL for a dashboard that could convince the user to click the link.

CVSS 6.1 · Medium · EPSS 64.0% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • apache superset

    Versions
    • ≥ Apache Superset, ≤ 1.0.1: Affected (custom)

    No fix published

  • superset PyPI

    Versions
    • 0.13.2
    • 0.14.0
    • 0.14.1
    • 0.15.0
    • 0.15.1
    • 0.15.3
    • 0.15.4
    • 0.17.0
    • 0.17.1
    • 0.17.2
    • 0.17.3
    • 0.17.4
    • 0.17.5
    • 0.17.6
    • 0.18.0
    • 0.18.2
    • 0.18.3
    • 0.18.4
    • 0.18.5
    • 0.19.0
    • 0.19.1
    • 0.20.0
    • 0.20.1
    • 0.20.2
    • 0.20.3
    • 0.20.4
    • 0.20.5
    • 0.20.6
    • 0.21.0
    • 0.21.1
    • 0.22.0
    • 0.22.1
    • 0.23.0
    • 0.23.1
    • 0.23.2
    • 0.23.3
    • 0.24.0
    • 0.25.0
    • 0.25.1
    • 0.25.2
    • 0.25.3
    • 0.25.4
    • 0.25.5
    • 0.25.6
    • 0.26.0
    • 0.26.2
    • 0.26.3
    • 0.27.0
    • 0.27.0rc1
    • 0.28.0
    • 0.28.1
    • 0.29.0rc6
    • 0.29.0rc7
    • 0.30.0
    • 0.30.1
    Affected ranges
    • ECOSYSTEM: ≤ 0.34.0

    No fix published

  • apache-superset PyPI

    Versions
    • 0.34.0
    • 0.34.1
    • 0.35.1
    • 0.35.2
    • 0.36.0
    • 0.37.0
    • 0.37.1
    • 0.37.2
    • 0.38.0
    • 0.38.1
    • 1.0.0
    • 1.0.1
    Affected ranges
    • ECOSYSTEM: < 1.1.0

    Update to 1.1.0

Original sources

Check your server →