Apache: >> Superset >> 1.5.0 Security Vulnerabilities
An authenticated attacker with write CSS template permissions can create a record with specific HTML tags that will not get properly escaped by the toast message displayed when a user deletes that specific CSS template record. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.
CVSS Score
5.4
EPSS Score
0.004
Published
2023-01-16
An authenticated attacker with update datasets permission could change a dataset link to an untrusted site, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.
CVSS Score
5.4
EPSS Score
0.002
Published
2023-01-16
When explicitly enabling the feature flag DASHBOARD_CACHE (disabled by default), the system allowed for an unauthenticated user to access dashboard configuration metadata using a REST API Get endpoint. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.
CVSS Score
5.3
EPSS Score
0.003
Published
2023-01-16
Apache Superset up to 1.5.1 allowed for authenticated users to access metadata information related to datasets they have no permission on. This metadata included the dataset name, columns and metrics.
CVSS Score
4.3
EPSS Score
0.002
Published
2022-07-06
Page 5