Apache: >> Superset >> 2.0.0 Security Vulnerabilities
Two legacy REST API endpoints for approval and request access are vulnerable to cross site request forgery. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.
CVSS Score
8.8
EPSS Score
0.003
Published
2023-01-16
An authenticated attacker with write CSS template permissions can create a record with specific HTML tags that will not get properly escaped by the toast message displayed when a user deletes that specific CSS template record. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.
CVSS Score
5.4
EPSS Score
0.004
Published
2023-01-16
An authenticated attacker with update datasets permission could change a dataset link to an untrusted site, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.
CVSS Score
5.4
EPSS Score
0.002
Published
2023-01-16
When explicitly enabling the feature flag DASHBOARD_CACHE (disabled by default), the system allowed for an unauthenticated user to access dashboard configuration metadata using a REST API Get endpoint. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.
CVSS Score
5.3
EPSS Score
0.003
Published
2023-01-16
Page 5