AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

Apache SupersetGHSA-5fp8-c45m-256p

Improper Encoding or Escaping of Output in Apache Superset

Apache Superset

CVE-2021-42250 · Published May 24, 2022 · updated Feb 5, 2025

High6.5
Fix: upgrade to 1.3.2 or later
GitHub advisory

Improper output neutralization for Logs. A specific Apache Superset HTTP endpoint allowed for an authenticated user to forge log entries or inject malicious content into logs.

Affected versions

PackageAffectedFixed in
apache-superset
PyPI
< 1.3.21.3.2
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-116
Also known as
BIT-superset-2021-42250, CVE-2021-42250, PYSEC-2021-435

More Apache Superset advisories

All Apache Superset
Medium 5.4May 24, 2022Apache Superset Stored XSS on Dashboard markdownCVE-2021-27907fixed in 0.38.1High 8.8May 24, 2022Apache Superset OS Command InjectionCVE-2020-13948fixed in 0.37.1High 6.5May 24, 2022Apache Superset allowed for database connections password leak for authenticated usersCVE-2021-41972fixed in 1.3.2Medium 5.4May 24, 2022Apache Superset Cross-site Scripting (XSS) vulnerability on the Explore pageCVE-2021-32609fixed in 1.2.0High 8.8May 24, 2022Apache Superset SQL Injection when template processing is enabledCVE-2021-41971fixed in 1.3.1Critical 9.8Apr 14, 2022SQL injection in apache-supersetCVE-2022-27479fixed in 1.4.2