CVE-2023-43701

Published: Nov 27, 2023Modified: Jun 17, 2026

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: NVD

Description

Improper payload validation and an improper REST API response type, made it possible for an authenticated malicious actor to store malicious code into Chart's metadata, this code could get executed if a user specifically accesses a specific deprecated API endpoint. This issue affects Apache Superset versions prior to 2.1.2. Users are recommended to upgrade to version 2.1.2, which fixes this issue.

Affected (1)

Products: Apache: Superset

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Superset	Before 2.1.2

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (4)

https://lists.apache.org/thread/4dnr1knk50fw60jxkjgqj228f0xcc892

Source: security@apache.org

Mailing List

https://www.openwall.com/lists/oss-security/2023/11/27/4

Source: security@apache.org

Mailing List

https://lists.apache.org/thread/4dnr1knk50fw60jxkjgqj228f0xcc892

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

https://www.openwall.com/lists/oss-security/2023/11/27/4

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

Timeline

No history available yet.