Apache Software Foundation · Apache Superset
Apache Superset up to and including 0.38.0 fails to sanitise the Markdown component that can be added to Dashboard pages, allowing stored cross-site scripting.
Apache Superset up to and including 0.38.0 allowed the creation of a Markdown component on a Dashboard page for describing chart's related information. Abusing this functionality, a malicious user could inject javascript code executing unwanted action in the context of the user's browser. The javascript code will be automatically executed (Stored XSS) when a legitimate user surfs on the dashboard page. The vulnerability is exploitable creating a “div” section and embedding in it a “svg” element with javascript code.
Disclosed on 5 Mar 2021. No public exploit code or confirmed exploitation is recorded.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
1 package in 1 ecosystem. Main package: apache-superset.
Upgrade to 0.38.1
Still affected on this line by CVE-2021-28125 (fixed in 1.1.0, a newer line); CVE-2023-27524 (fixed in 2.1.0, a newer line); CVE-2023-39265 (fixed in 2.1.1, a newer line).
pip install "apache-superset>=0.38.1"The first fix for CVE-2021-27907.
| If you run | Upgrade to |
|---|---|
| All versions before 0.38.1 | 0.38.1 |
“Up to” means the second version is the fix and is not affected.