p PatchFirst

CVE-2023-42502

CVE-2023-42502 · Apache Superset: Open Redirect Vulnerability

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An authenticated attacker with update datasets permission could change a dataset link to an untrusted site by spoofing the HTTP Host header, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset versions before 3.0.0.

CVSS 4.8 · Medium · EPSS 0.8% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • apache superset

    Versions
    • ≥ 0, < 3.0.0: Affected (semver)

    Update to 3.0.0

  • apache-superset PyPI

    Versions
    • 0.34.0
    • 0.34.1
    • 0.35.1
    • 0.35.2
    • 0.36.0
    • 0.37.0
    • 0.37.1
    • 0.37.2
    • 0.38.0
    • 0.38.1
    • 1.0.0
    • 1.0.1
    • 1.1.0
    • 1.2.0
    • 1.3.0
    • 1.3.1
    • 1.3.2
    • 1.4.0
    • 1.4.1
    • 1.4.2
    • 1.5.0
    • 1.5.1
    • 1.5.2
    • 1.5.3
    • 2.0.0
    • 2.0.1
    • 2.1.0
    • 2.1.1
    • 2.1.1rc1
    • 2.1.1rc2
    • 2.1.1rc3
    • 2.1.2
    • 2.1.3
    • 3.0.0rc1
    • 3.0.0rc2
    • 3.0.0rc3
    • 3.0.0rc4
    Affected ranges
    • ECOSYSTEM: < 3.0.0

    Update to 3.0.0

Original sources

Check your server →