AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Apache SupersetGHSA-hc74-9vjm-c9xv

Apache Superset Open Redirect vulnerability

Apache Superset

CVE-2023-42502 · Published Nov 28, 2023 · updated Jul 7, 2026

Medium5.4
Fix: upgrade to 3.0.0 or later
GitHub advisory

An authenticated attacker with update datasets permission could change a dataset link to an untrusted site by spoofing the HTTP Host header, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset versions before 3.0.0.

Affected versions

PackageAffectedFixed in
apache-superset
PyPI
< 3.0.03.0.0
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-601
Also known as
BIT-superset-2023-42502, CVE-2023-42502, PYSEC-2026-1182

More Apache Superset advisories

All Apache Superset
Medium 6.5Dec 19, 2023Apache Superset SQL injection vulnerabilityCVE-2023-49736fixed in 2.1.3 +1High 7.3Nov 28, 2023Apache Superset - Elevation of PrivilegeCVE-2023-40610fixed in 2.1.2Medium 6.5Nov 28, 2023Apache Superset Allocation of Resources Without Limits or Throttling vulnerabilityCVE-2023-42504fixed in 3.0.0Medium 4.3Nov 28, 2023Apache Superset Exposure of Sensitive Information to an Unauthorized Actor vulnerabilityCVE-2023-42505fixed in 3.0.0Medium 4.3Nov 27, 2023Apache Superset has Incorrect Default PermissionsCVE-2023-42501fixed in 2.1.2Medium 4.3Nov 27, 2023Apache Superset Cross-site Scripting vulnerabilityCVE-2023-43701fixed in 2.1.2