p PatchFirst

CVE-2023-43701

CVE-2023-43701 · Apache Superset: Stored XSS on API endpoint

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Improper payload validation and an improper REST API response type, made it possible for an authenticated malicious actor to store malicious code into Chart's metadata, this code could get executed if a user specifically accesses a specific deprecated API endpoint. This issue affects Apache Superset versions prior to 2.1.2.  Users are recommended to upgrade to version 2.1.2, which fixes this issue.

CVSS 4.3 · Medium · EPSS 1.0% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • apache superset

    Versions
    • ≥ 0, < 2.1.2: Affected (semver)

    Update to 2.1.2

  • apache-superset PyPI

    Versions
    • 0.34.0
    • 0.34.1
    • 0.35.1
    • 0.35.2
    • 0.36.0
    • 0.37.0
    • 0.37.1
    • 0.37.2
    • 0.38.0
    • 0.38.1
    • 1.0.0
    • 1.0.1
    • 1.1.0
    • 1.2.0
    • 1.3.0
    • 1.3.1
    • 1.3.2
    • 1.4.0
    • 1.4.1
    • 1.4.2
    • 1.5.0
    • 1.5.1
    • 1.5.2
    • 1.5.3
    • 2.0.0
    • 2.0.1
    • 2.1.0
    • 2.1.1
    • 2.1.1rc1
    • 2.1.1rc2
    • 2.1.1rc3
    Affected ranges
    • ECOSYSTEM: < 2.1.2

    Update to 2.1.2

Original sources

Check your server →