{"id":"CVE-2021-28125","published":"2021-04-27T09:27:22Z","modified":"2024-08-03T21:33:17Z","title":"Apache Superset Open Redirect","vendor":"Apache Software Foundation","product":"Apache Superset","tier":"core","eol":null,"affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache Superset","versions":[">= Apache Superset, <= 1.0.1"]}],"description":{"text":"Apache Superset up to and including 1.0.1 allowed for the creation of an external URL that could be malicious. By not checking user input for open redirects the URL shortener functionality would allow for a malicious user to create a short URL for a dashboard that could convince the user to click the link.","provenance":"source","from":"CVE.org"},"summary":{"text":"Apache Superset, up to and including version 1.0.1, has an open redirect flaw in its URL shortener functionality, which does not validate user-supplied input.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:23:54Z"},"cvss":null,"epss":{"score":0.64016,"percentile":0.99223,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-601","name":"URL Redirection to Untrusted Site"}],"references":[{"url":"https://lists.apache.org/thread.html/r89b5d0dd35c1adc9624b48d6247729c73b2641b32754226661368434%40%3Cdev.superset.apache.org%3E","tags":["x_refsource_MISC"]},{"url":"http://www.openwall.com/lists/oss-security/2021/04/27/2","tags":["mailing-list","x_refsource_MLIST"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"PyPI","package":"superset","vulnerableRanges":["<=0.34.0"],"patched":[],"from":["GHSA-pfwg-rxf4-97c3","PYSEC-2026-3078"],"provenance":"source"},{"ecosystem":"PyPI","package":"apache-superset","vulnerableRanges":["<1.1.0"],"patched":["1.1.0"],"from":["GHSA-pfwg-rxf4-97c3","PYSEC-2021-128"],"provenance":"source"}],"advisories":[{"id":"GHSA-pfwg-rxf4-97c3","url":"https://github.com/advisories/GHSA-pfwg-rxf4-97c3","severity":"MODERATE","ecosystem":"PyPI","package":"superset","vulnerableRanges":["<=0.34.0"],"patched":[],"provenance":"source","from":"GHSA"},{"id":"GHSA-pfwg-rxf4-97c3","url":"https://github.com/advisories/GHSA-pfwg-rxf4-97c3","severity":"MODERATE","ecosystem":"PyPI","package":"apache-superset","vulnerableRanges":["<1.1.0"],"patched":["1.1.0"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2021-0020","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-0020","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2021-04-27","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2021-28125","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":19.8,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.84,"detail":"percentile 0.9922"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2020-13948","published":"2020-09-17","fixed":"0.37.1","kev":false},{"cve":"CVE-2020-13952","published":"2020-09-30","fixed":"0.37.2","kev":false},{"cve":"CVE-2021-27907","published":"2021-03-05","fixed":"0.38.1","kev":false},{"cve":"CVE-2021-28125","published":"2021-04-27","fixed":"1.1.0","kev":false},{"cve":"CVE-2021-32609","published":"2021-10-18","fixed":"1.2.0","kev":false,"link":{"from":"CVE-2021-28125","to":"CVE-2021-32609","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:apache-superset","fromFixed":"1.1.0","toFixed":"1.2.0","daysApart":174}]}},{"cve":"CVE-2021-41971","published":"2021-10-18","fixed":"1.3.1","kev":false},{"cve":"CVE-2021-41972","published":"2021-11-12","fixed":"1.3.2","kev":false}],"package":"PyPI:apache-superset"}}