medium5.4
CVE-2021-32609
Apache Superset Cross-site Scripting (XSS) vulnerability on the Explore page
Impact
Apache Superset up to and including 1.1 does not sanitize titles correctly on the Explore page. This allows an attacker with Explore access to save a chart with a malicious title, injecting html (including scripts) into the page.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | apache-superset | >= 0, < 1.2.0 | 1.2.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Superset | through 1.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://lists.apache.org/thread.html/r2c09254e98b4f8b3deb422762bd0e2aa6d743b72d96c2f90cbaae31a%40%3Cdev.superset.apache.org%3E
- https://github.com/advisories/GHSA-f8vc-f28w-x9c9
- https://nvd.nist.gov/vuln/detail/CVE-2021-32609
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-superset/PYSEC-2021-377.yaml