{"id":"CVE-2021-32609","published":"2021-10-18T14:30:12Z","modified":"2024-08-03T23:25:30Z","title":"XSS vulnerability on Explore page","vendor":"Apache","product":"Apache Superset","tier":"tail","description":{"text":"Apache Superset up to and including 1.1 does not sanitize titles correctly on the Explore page. This allows an attacker with Explore access to save a chart with a malicious title, injecting html (including scripts) into the page.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01655,"percentile":0.76484,"provenance":"source"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://lists.apache.org/thread.html/r2c09254e98b4f8b3deb422762bd0e2aa6d743b72d96c2f90cbaae31a%40%3Cdev.superset.apache.org%3E","tags":["x_refsource_MISC"]}],"priority":{"score":15.3,"factors":[{"name":"EPSS percentile","points":15.3}]},"vendorSlug":"apache","affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache Superset","versions":[">= unspecified, <= 1.1"]}],"affected":[{"ecosystem":"PyPI","package":"apache-superset","vulnerableRanges":["<1.2.0"],"patched":["1.2.0"],"from":["GHSA-f8vc-f28w-x9c9","PYSEC-2021-377"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-0021","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2020-13952","published":"2020-09-30","fixed":"0.37.2","kev":false},{"cve":"CVE-2021-27907","published":"2021-03-05","fixed":"0.38.1","kev":false},{"cve":"CVE-2021-28125","published":"2021-04-27","fixed":"1.1.0","kev":false,"link":{"from":"CVE-2021-28125","to":"CVE-2021-32609","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:apache-superset","fromFixed":"1.1.0","toFixed":"1.2.0","daysApart":174}]}},{"cve":"CVE-2021-32609","published":"2021-10-18","fixed":"1.2.0","kev":false},{"cve":"CVE-2021-41971","published":"2021-10-18","fixed":"1.3.1","kev":false,"link":{"from":"CVE-2021-32609","to":"CVE-2021-41971","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:apache-superset","fromFixed":"1.2.0","toFixed":"1.3.1","daysApart":0}]}},{"cve":"CVE-2021-41972","published":"2021-11-12","fixed":"1.3.2","kev":false},{"cve":"CVE-2021-42250","published":"2021-11-17","fixed":"1.3.2","kev":false}],"package":"PyPI:apache-superset"}}