Apache Superset: Open Redirect Vulnerability
CVE-2023-42502

5.4MEDIUM

Key Information:

Vendor: Apache
Status: Apache Superset
Vendor: CVE Published:; 28 November 2023

What is CVE-2023-42502?

An authenticated attacker with update datasets permission could change a dataset link to an untrusted site by spoofing the HTTP Host header, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset versions before 3.0.0.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Apache Superset 0 < 3.0.0

References

https://lists.apache.org/thread/n8348f194d8o8mln3oxd0s8jd...

vendor-advisory

CVSS V3.1

Score:

5.4

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

Required

Scope:

Changed

Timeline

Vulnerability published
Nov 28, 2023
Vulnerability Reserved
Sep 11, 2023

Credit

Amit Laish – GE Vernova

JSON

Apache