p PatchFirst

CVE-2022-43717

CVE-2022-43717 · Apache Superset: Cross-Site Scripting on dashboards

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Dashboard rendering does not sufficiently sanitize the content of markdown components leading to possible XSS attack vectors that can be performed by authenticated users with create dashboard permissions. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

CVSS 5.4 · Medium · EPSS 1.3% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • apache superset

    Versions
    • ≥ 2.0.0, < 2.0.1: Affected (semver)
    • ≥ 0, ≤ 1.5.2: Affected (semver)

    Update to 2.0.1

  • apache-superset PyPI

    Versions
    • 0.34.0
    • 0.34.1
    • 0.35.1
    • 0.35.2
    • 0.36.0
    • 0.37.0
    • 0.37.1
    • 0.37.2
    • 0.38.0
    • 0.38.1
    • 1.0.0
    • 1.0.1
    • 1.1.0
    • 1.2.0
    • 1.3.0
    • 1.3.1
    • 1.3.2
    • 1.4.0
    • 1.4.1
    • 1.4.2
    • 1.5.0
    • 1.5.1
    • 1.5.2
    Affected ranges
    • ECOSYSTEM: ≤ 1.5.2

    No fix published

  • apache-superset PyPI

    Versions
    • 2.0.0

    No fix published

  • apache-superset PyPI

    Versions
    • 0.34.0
    • 0.34.1
    • 0.35.1
    • 0.35.2
    • 0.36.0
    • 0.37.0
    • 0.37.1
    • 0.37.2
    • 0.38.0
    • 0.38.1
    • 1.0.0
    • 1.0.1
    • 1.1.0
    • 1.2.0
    • 1.3.0
    • 1.3.1
    • 1.3.2
    • 1.4.0
    • 1.4.1
    • 1.4.2
    • 1.5.0
    • 1.5.1
    • 1.5.2
    • 2.0.0
    Affected ranges
    • ECOSYSTEM: < 1.5.3 ∪ ≥ 2.0.0, < 2.0.1

    Update to 1.5.3; Update to 2.0.1

Original sources

Check your server →