BIT-superset-2022-43719

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/superset/BIT-superset-2022-43719.json

JSON Data

https://api.osv.dev/v1/vulns/BIT-superset-2022-43719

Aliases

Published

2025-02-05T07:29:05Z

Modified

2026-09-08T08:48:16Z

Summary

Apache Superset: Cross Site Request Forgery (CSRF) on accept, request access API

Details

Two legacy REST API endpoints for approval and request access are vulnerable to cross site request forgery. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

Database specific

{
    "cpes":  [
        "cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:superset:2.0.0:-:*:*:*:*:*:*",
        "cpe:2.3:a:apache:superset:2.0.0:rc1:*:*:*:*:*:*",
        "cpe:2.3:a:apache:superset:2.0.0:rc2:*:*:*:*:*:*"
    ],
    "severity":  "High"
}

References

Affected packages

Bitnami / superset

Package

Name: superset
Purl: pkg:bitnami/superset

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.5.3

Introduced

2.0.0

Fixed

2.0.1

Database specific

source

"https://github.com/bitnami/vulndb/tree/main/data/superset/BIT-superset-2022-43719.json"