CVE-2023-42502
published 2023-11-28CVE-2023-42502: An authenticated attacker with update datasets permission could change a dataset link to an untrusted site by spoofing the HTTP Host header, users could be…
PriorityP426medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
EPSS
0.82%
53.1th percentile
An authenticated attacker with update datasets permission could change a dataset link to an untrusted site by spoofing the HTTP Host header, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset versions before 3.0.0.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | superset | < 3.0.0 | 3.0.0 |
| apache_software_foundation | apache_superset | < 3.0.0 | 3.0.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Apache Superset Open Redirect vulnerability
ghsa·2023-11-28
CVE-2023-42502 [MEDIUM] CWE-601 Apache Superset Open Redirect vulnerability
Apache Superset Open Redirect vulnerability
An authenticated attacker with update datasets permission could change a dataset link to an untrusted site by spoofing the HTTP Host header, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset versions before 3.0.0.
OSV
Apache Superset Open Redirect vulnerability
osv·2023-11-28
CVE-2023-42502 [MEDIUM] Apache Superset Open Redirect vulnerability
Apache Superset Open Redirect vulnerability
An authenticated attacker with update datasets permission could change a dataset link to an untrusted site by spoofing the HTTP Host header, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset versions before 3.0.0.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-11-28
Published