Apache SupersetGHSA-fcg4-pm6h-9xx2
Apache Superset Open Redirect vulnerability
Medium5.4CVE-2022-43721 · Published Jan 16, 2023 · updated Jul 7, 2026
An authenticated attacker with update datasets permission could change a dataset link to an untrusted site, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| apache-superset PyPI | <= 1.5.2 | No fix yet |
| <= 2.0.0 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-601
- Also known as
- BIT-superset-2022-43721, CVE-2022-43721, PYSEC-2026-781
More Apache Superset advisories
All Apache Superset| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jan 162023 | Apache Superset vulnerable to Cross-Site Request Forgery via legacy REST API endpoints High8.8Jan 16, 2023 | High8.8 | No fix yet |
| Jan 162023 | Apache Superset is vulnerable to Cross-Site Scripting (XSS)Medium5.4Jan 16, 2023 | Medium5.4 | No fix yet |
| Jan 162023 | Apache Superset vulnerable to Cross-site ScriptingMedium5.4Jan 16, 2023 | Medium5.4 | No fix yet |
| Jan 162023 | Apache Superset's SQL Alchemy connector vulnerable to SQL InjectionMedium5.4Jan 16, 2023 | Medium5.4 | No fix yet |
| Jan 162023 | Apache Superset has Improper Access ControlMedium5.3Jan 16, 2023 | Medium5.3 | No fix yet |
| Jan 162023 | Apache Superset vulnerable to InjectionMedium5.4Jan 16, 2023 | Medium5.4 | No fix yet |