Advisoriesby IbisApache SupersetGHSA-pfwg-rxf4-97c3
Open Redirect in Apache Superset
Fix: upgrade to 1.1.0 or later
Apache Superset prior to 1.1.0 allowed for the creation of an external URL that could be malicious. By not checking user input for open redirects the URL shortener functionality would allow for a malicious user to create a short URL for a dashboard that could convince the user to click the link.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| apache-superset PyPI | < 1.1.0 | 1.1.0 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-601
- Also known as
- BIT-superset-2021-28125, CVE-2021-28125, PYSEC-2021-128, PYSEC-2026-3078
- nvd.nist.gov/vuln/detail/CVE-2021-28125
- github.com/apache/superset/commit/eb35b804acf4d84cb70d02743e04b8afebbee029
- github.com/advisories/GHSA-pfwg-rxf4-97c3
- github.com/apache/superset
- github.com/pypa/advisory-database/tree/main/vulns/apache-superset/PYSEC-2021-128.yaml
- lists.apache.org/thread.html/r89b5d0dd35c1adc9624b48d6247729c73b2641b32754226661368434%40%3Cdev.superset.apache.org%3E
- lists.apache.org/thread.html/r89b5d0dd35c1adc9624b48d6247729c73b2641b32754226661368434@%3Cdev.superset.apache.org%3E
- www.openwall.com/lists/oss-security/2021/04/27/2
More Apache Superset advisories
All Apache Superset
Apache Superset allowed for database connections password leak for authenticated usersCVE-2021-41972fixed in 1.3.2Apache Superset Cross-site Scripting (XSS) vulnerability on the Explore pageCVE-2021-32609fixed in 1.2.0Apache Superset SQL Injection when template processing is enabledCVE-2021-41971fixed in 1.3.1SQL injection in apache-supersetCVE-2022-27479fixed in 1.4.2Insufficiently Protected Credentials in Apache SupersetCVE-2021-44451fixed in 1.4.0Plaintext password leak in Apache SupersetCVE-2020-13952fixed in 0.37.2