What is GHSA-9f88-wg5r-947j?

GHSA-9f88-wg5r-947j is a security advisory published by GitHub Security Advisories with Medium severity. Apache Superset vulnerable to Cross-site Scripting

Which CVE IDs does GHSA-9f88-wg5r-947j cover?

GHSA-9f88-wg5r-947j covers the following CVE IDs: CVE-2022-43717. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-9f88-wg5r-947j?

GHSA-9f88-wg5r-947j has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

Which products are affected by GHSA-9f88-wg5r-947j?

GHSA-9f88-wg5r-947j affects 2 products, including: pip/apache-superset:\u003c= 1.5.2; pip/apache-superset:= 2.0.0.

GHSA-9f88-wg5r-947jMediumCVSS 5.4

Apache Superset vulnerable to Cross-site Scripting

Vendor

GitHub Security Advisories

Published

January 16, 2023

Last Modified

January 24, 2023

🔗 CVE IDs covered (1)

CVE-2022-43717 →

📋 Description

Dashboard rendering does not sufficiently sanitize the content of markdown components leading to possible XSS attack vectors that can be performed by authenticated users with create dashboard permissions. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

🎯 Affected products2

pip/apache-superset:<= 1.5.2
pip/apache-superset:= 2.0.0

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2022-43717
https://lists.apache.org/thread/g6zy6vkpvkbj5mj32vmyzwol5ldtg9pl
https://github.com/advisories/GHSA-9f88-wg5r-947j