CVE-2022-43718CWE-79

Apache Superset: Cross-Site Scripting vulnerability on upload forms

Medium · published January 16, 2023

CVSS v3.1
5.4
EPSS
1%
Percentile
66.4
In the wild
Unconfirmed
What it is

Upload data forms do not correctly render user input leading to possible XSS attack vectors that can be performed by authenticated users with database connection update permissions. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01142 · 66.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2023-01-16T10:10Z
EPSS history
Timeline
  • 16 JAN 10:10Z
    Apache Superset: Cross-Site Scripting vulnerability on upload forms
    cvelistv5