CVE-2023-42502

Published: Nov 28, 2023Modified: Jun 17, 2026

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: NVD

Description

An authenticated attacker with update datasets permission could change a dataset link to an untrusted site by spoofing the HTTP Host header, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset versions before 3.0.0.

Affected (1)

Products: Apache: Superset

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Superset	Before 3.0.0

Related CWEs

URL Redirection to Untrusted Site ('Open Redirect')

A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.

References (2)

https://lists.apache.org/thread/n8348f194d8o8mln3oxd0s8jdl5bxbmn

Source: security@apache.org

Mailing ListThird Party Advisory

https://lists.apache.org/thread/n8348f194d8o8mln3oxd0s8jdl5bxbmn

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

Timeline

No history available yet.