ghsa-9f88-wg5r-947j
Vulnerability from github
Published
2023-01-16 12:30
Modified
2023-01-24 18:52
Severity ?
VLAI Severity ?
Summary
Apache Superset vulnerable to Cross-site Scripting
Details
Dashboard rendering does not sufficiently sanitize the content of markdown components leading to possible XSS attack vectors that can be performed by authenticated users with create dashboard permissions. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.
{ "affected": [ { "package": { "ecosystem": "PyPI", "name": "apache-superset" }, "ranges": [ { "events": [ { "introduced": "0" }, { "last_affected": "1.5.2" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "PyPI", "name": "apache-superset" }, "versions": [ "2.0.0" ] } ], "aliases": [ "CVE-2022-43717" ], "database_specific": { "cwe_ids": [ "CWE-79" ], "github_reviewed": true, "github_reviewed_at": "2023-01-20T23:16:57Z", "nvd_published_at": "2023-01-16T11:15:00Z", "severity": "MODERATE" }, "details": "Dashboard rendering does not sufficiently sanitize the content of markdown components leading to possible XSS attack vectors that can be performed by authenticated users with create dashboard permissions. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.", "id": "GHSA-9f88-wg5r-947j", "modified": "2023-01-24T18:52:46Z", "published": "2023-01-16T12:30:18Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43717" }, { "type": "PACKAGE", "url": "https://github.com/apache/superset" }, { "type": "WEB", "url": "https://lists.apache.org/thread/g6zy6vkpvkbj5mj32vmyzwol5ldtg9pl" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "type": "CVSS_V3" } ], "summary": "Apache Superset vulnerable to Cross-site Scripting" }
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…