medium5.4
CVE-2022-43720
Apache Superset vulnerable to Injection
Impact
An authenticated attacker with write CSS template permissions can create a record with specific HTML tags that will not get properly escaped by the toast message displayed when a user deletes that specific CSS template record. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | apache-superset | <= 1.5.2 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Superset | through 1.5.2 Version 2.0.0 |