Apache Superset: Stored XSS on API endpoint
CVE-2023-43701

5.4MEDIUM

Key Information:

Vendor

Apache
Status
Apache Superset
Vendor
CVE Published:
27 November 2023

What is CVE-2023-43701?

Improper payload validation and an improper REST API response type, made it possible for an authenticated malicious actor to store malicious code into Chart's metadata, this code could get executed if a user specifically accesses a specific deprecated API endpoint. This issue affects Apache Superset versions prior to 2.1.2.  Users are recommended to upgrade to version 2.1.2, which fixes this issue.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Apache Superset 0 < 2.1.2

References

https://lists.apache.org/thread/4dnr1knk50fw60jxkjgqj228f...
vendor-advisory
https://www.openwall.com/lists/oss-security/2023/11/27/4

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Amit Laish – GE Vernova
JSON
.