Apache Superset Open Redirect
Apache Software Foundation · Apache Superset
Apache Superset, up to and including version 1.0.1, has an open redirect flaw in its URL shortener functionality, which does not validate user-supplied input.
Apache Superset up to and including 1.0.1 allowed for the creation of an external URL that could be malicious. By not checking user input for open redirects the URL shortener functionality would allow for a malicious user to create a short URL for a dashboard that could convince the user to click the link.
- Exploited
- Not confirmed
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
Disclosed on 27 Apr 2021. No public exploit code or confirmed exploitation is recorded.
Patch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.
7 fixes in apache-superset over 14 months. The latest fix listed for apache-superset is 1.3.2.
Fixes in apache-supersetPyPI package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.
- 0.37.1CVE-2020-1394817 Sep 2020
- 0.37.2CVE-2020-1395230 Sep 2020
- 0.38.1CVE-2021-279075 Mar 2021
- 1.1.0CVE-2021-2812527 Apr 2021
- 1.2.0CVE-2021-3260918 Oct 2021
- 1.3.1CVE-2021-4197118 Oct 2021
- 1.3.2CVE-2021-4197212 Nov 2021Latest listed
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
Am I affected? What do I upgrade to?
From GitHub Security Advisories and OSV2 packages in 1 ecosystem. No single main package: each of these ships the affected code.
- PyPIapache-supersetAffected: All versions before 1.1.0Upgrade to 1.1.0 or later
- PyPIsupersetAffected: 0.34.0 and earlierNo fixed version published