CVE-2022-43717CWE-79

Apache Superset: Cross-Site Scripting on dashboards

Medium · published January 16, 2023

CVSS v3.1
5.4
EPSS
1%
Percentile
69.2
In the wild
Unconfirmed
What it is

Dashboard rendering does not sufficiently sanitize the content of markdown components leading to possible XSS attack vectors that can be performed by authenticated users with create dashboard permissions. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01250 · 69.2th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2023-01-16T10:08Z
EPSS history
Timeline
  • 16 JAN 10:08Z
    Apache Superset: Cross-Site Scripting on dashboards
    cvelistv5