AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Apache SupersetGHSA-7222-r37x-8q3m

Apache Superset vulnerable to Cross-Site Request Forgery via legacy REST API endpoints

Apache Superset

CVE-2022-43719 · Published Jan 16, 2023 · updated Jul 7, 2026

High8.8
No fix yet
GitHub advisory

Two legacy REST API endpoints for approval and request access are vulnerable to cross site request forgery. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

Affected versions

PackageAffectedFixed in
apache-superset
PyPI
<= 1.5.2No fix yet
<= 2.0.0No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-352
Also known as
BIT-superset-2022-43719, CVE-2022-43719, PYSEC-2026-775

More Apache Superset advisories

All Apache Superset
Medium 5.4Jan 16, 2023Apache Superset is vulnerable to Cross-Site Scripting (XSS)CVE-2022-43718no fix yetMedium 5.4Jan 16, 2023Apache Superset vulnerable to Cross-site ScriptingCVE-2022-43717no fix yetMedium 5.4Jan 16, 2023Apache Superset's SQL Alchemy connector vulnerable to SQL InjectionCVE-2022-41703no fix yetMedium 5.3Jan 16, 2023Apache Superset has Improper Access ControlCVE-2022-45438no fix yetMedium 5.4Jan 16, 2023Apache Superset Open Redirect vulnerabilityCVE-2022-43721no fix yetMedium 5.4Jan 16, 2023Apache Superset vulnerable to InjectionCVE-2022-43720no fix yet