GHSA-fcg4-pm6h-9xx2

Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/01/GHSA-fcg4-pm6h-9xx2/GHSA-fcg4-pm6h-9xx2.json
Aliases
  • CVE-2022-43721
Published
2023-01-16T12:30:17Z
Modified
2023-01-31T02:29:11.998693Z
Details

An authenticated attacker with update datasets permission could change a dataset link to an untrusted site, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

References

Affected packages

PyPI / apache-superset

apache-superset

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0
Last affected
1.5.2

Affected versions

0.*

0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1

1.*

1.0.0
1.0.1
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2

PyPI / apache-superset

apache-superset

Affected ranges

Affected versions

2.*

2.0.0