What is GHSA-79x5-cv79-49rj?

GHSA-79x5-cv79-49rj is a security advisory published by GitHub Security Advisories with Medium severity. Apache Superset is vulnerable to Cross-Site Scripting (XSS)

Which CVE IDs does GHSA-79x5-cv79-49rj cover?

GHSA-79x5-cv79-49rj covers the following CVE IDs: CVE-2022-43718. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-79x5-cv79-49rj?

GHSA-79x5-cv79-49rj has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

Which products are affected by GHSA-79x5-cv79-49rj?

GHSA-79x5-cv79-49rj affects 2 products, including: pip/apache-superset:\u003c= 1.5.2; pip/apache-superset:= 2.0.0.

GHSA-79x5-cv79-49rjMediumCVSS 5.4

Apache Superset is vulnerable to Cross-Site Scripting (XSS)

Vendor

GitHub Security Advisories

Published

January 16, 2023

Last Modified

January 24, 2023

🔗 CVE IDs covered (1)

CVE-2022-43718 →

📋 Description

Upload data forms do not correctly render user input leading to possible XSS attack vectors that can be performed by authenticated users with database connection update permissions. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

🎯 Affected products2

pip/apache-superset:<= 1.5.2
pip/apache-superset:= 2.0.0

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2022-43718
https://lists.apache.org/thread/8615608jt2x7b3rmqrtngldy8pn3nz2r
https://github.com/advisories/GHSA-79x5-cv79-49rj