CVE-2021-28125CWE-601

Apache Superset Open Redirect

published April 27, 2021

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.2th percentile for exploit probability.

CVSS
—
EPSS
64%
Percentile
99.2
In the wild
Unconfirmed
What it is

Apache Superset up to and including 1.0.1 allowed for the creation of an external URL that could be malicious. By not checking user input for open redirects the URL shortener functionality would allow for a malicious user to create a short URL for a dashboard that could convince the user to click the link.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.64016 · 99.2th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2021-04-27T09:27Z
EPSS history
Timeline
  • 27 APR 09:27Z
    Apache Superset Open Redirect
    cvelistv5