AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Apache SupersetGHSA-fcg4-pm6h-9xx2

Apache Superset Open Redirect vulnerability

Apache Superset

CVE-2022-43721 · Published Jan 16, 2023 · updated Jul 7, 2026

Medium5.4
No fix yet
GitHub advisory

An authenticated attacker with update datasets permission could change a dataset link to an untrusted site, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

Affected versions

PackageAffectedFixed in
apache-superset
PyPI
<= 1.5.2No fix yet
<= 2.0.0No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-601
Also known as
BIT-superset-2022-43721, CVE-2022-43721, PYSEC-2026-781

More Apache Superset advisories

All Apache Superset
High 8.8Jan 16, 2023Apache Superset vulnerable to Cross-Site Request Forgery via legacy REST API endpointsCVE-2022-43719no fix yetMedium 5.4Jan 16, 2023Apache Superset is vulnerable to Cross-Site Scripting (XSS)CVE-2022-43718no fix yetMedium 5.4Jan 16, 2023Apache Superset vulnerable to Cross-site ScriptingCVE-2022-43717no fix yetMedium 5.4Jan 16, 2023Apache Superset's SQL Alchemy connector vulnerable to SQL InjectionCVE-2022-41703no fix yetMedium 5.3Jan 16, 2023Apache Superset has Improper Access ControlCVE-2022-45438no fix yetMedium 5.4Jan 16, 2023Apache Superset vulnerable to InjectionCVE-2022-43720no fix yet