Apache SupersetGHSA-79x5-cv79-49rj
Apache Superset is vulnerable to Cross-Site Scripting (XSS)
Medium5.4CVE-2022-43718 · Published Jan 16, 2023 · updated Jul 7, 2026
Upload data forms do not correctly render user input leading to possible XSS attack vectors that can be performed by authenticated users with database connection update permissions. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| apache-superset PyPI | <= 1.5.2 | No fix yet |
| <= 2.0.0 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-79
- Also known as
- BIT-superset-2022-43718, CVE-2022-43718, PYSEC-2026-777
More Apache Superset advisories
All Apache Superset| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jan 162023 | Apache Superset vulnerable to Cross-Site Request Forgery via legacy REST API endpoints High8.8Jan 16, 2023 | High8.8 | No fix yet |
| Jan 162023 | Apache Superset vulnerable to Cross-site ScriptingMedium5.4Jan 16, 2023 | Medium5.4 | No fix yet |
| Jan 162023 | Apache Superset's SQL Alchemy connector vulnerable to SQL InjectionMedium5.4Jan 16, 2023 | Medium5.4 | No fix yet |
| Jan 162023 | Apache Superset has Improper Access ControlMedium5.3Jan 16, 2023 | Medium5.3 | No fix yet |
| Jan 162023 | Apache Superset Open Redirect vulnerabilityMedium5.4Jan 16, 2023 | Medium5.4 | No fix yet |
| Jan 162023 | Apache Superset vulnerable to InjectionMedium5.4Jan 16, 2023 | Medium5.4 | No fix yet |